CVE-2026-13341

Summary

A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.

Affected Software

Weaknesses

• CWE-20: CWE-20 Improper input validation

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/Kong/mcp-konnect/security/advisories/GHSA-7767-3m3w-2p44

• ←Previous
• Next→