Unrated severityNVD Advisory· Published Jul 3, 2026· Updated Jul 6, 2026

Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP

CVE-2026-13341

Description

A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.

Affected products

Kong/Konnect MCPllm-create
Range: <1.0.0

Patches

Vulnerability mechanics

References

github.com/Kong/mcp-konnect/security/advisories/GHSA-7767-3m3w-2p44mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000