CVE-2026-13341 — Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP

CVE-2026-13341

Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP PUBLISHED

Description (CNA)

A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.

Affected (CNA)

Vendor / product	Versions
KongHQ / mcp-konnect	affected 0 before 1.0.0

CWE

CWE-20

References

https://github.com/Kong/mcp-konnect/security/advisories/GHSA-7767-3m3w-2p44

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.