{"id":"CVE-2026-92544","kind":"vulnerability","aliases":["CVE-2026-92544"],"related":[],"title":"Kong AI Gateway: crafted model name lets clients run SQL on the database","description":"SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name.","summary":"Kong's changelog says a client-supplied model name was written into the license_llm_data table without escaping, allowing SQL injection from the LLM usage counters. Fixed in Gateway Enterprise 3.16.0.2 and in AI Gateway 2.3.0 (2.3.1 is current).","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Kong Gateway Enterprise","fixed":["3.16.0.2"],"affected":"< 3.16.0.2 (older branch ranges unknown)","ecosystem":"vendor"},{"name":"Kong AI Gateway","fixed":["2.3.0"],"affected":"< 2.3.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","kong","kong-ai-gateway","llm-gateway","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Run 'kong version' (or check the image tag) on every Kong Gateway Enterprise and Kong AI Gateway node. Below 3.16.0.2 on Gateway or below 2.3.0 on AI Gateway means the unescaped model name is written to the license_llm_data table. Affected ranges for older branches are not published in the pages read; check Kong's security advisories page for them.","fix":"Kong Gateway Enterprise: upgrade to 3.16.0.2 (released 2026-11-10); the 3.15.x branch got a 3.15.0.7 release the same day, but its changelog entry for this CVE was not seen, so confirm it lists CVE-2026-92544. Kong AI Gateway: the fix is listed in the 2.3.0 release (2026-11-04) per the vendor changelog; use 2.3.1 (2026-11-10) or later. Fix escapes every value before the usage counter SQL statement runs.","status":"open","published_at":"2026-11-10T21:21:40+00:00","first_seen_at":"2026-11-10T21:46:16+00:00","triaged_at":"2026-11-10T21:47:41+00:00","updated_at":"2026-11-10T21:49:18+00:00","category":"ai-tooling","confidence":0.65,"triage":{"at":"2026-11-10T21:47:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Kong AI Gateway: crafted model name lets clients run SQL on the database","impact":"high","summary":"The LLM usage counters in Kong Gateway Enterprise and Kong AI Gateway fail to sanitize a model name, so a crafted request can inject SQL. An attacker can run arbitrary SQL against the Kong database.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["kong","kong-ai-gateway","llm-gateway","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary SQL against the Kong database","analyst_note":"Find the affected and fixed versions and the vendor advisory from the NVD entry and Kong's security page, and confirm whether auth is required and which configuration exposes the counters.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Kong Gateway Enterprise or Kong AI Gateway with the LLM usage counters in use are exposed through requests that carry a crafted model name. The sources do not say which configurations or versions are affected, or whether clients need credentials first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":4528,"output_tokens":485,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed versions and the vendor advisory from the NVD entry and Kong's security page, and confirm whether auth is required and which configuration exposes the counters.","search":"'-2026':15A,18A '-92544':16A,19A '2.3.0':77B '2.3.1':78B '3.16.0.2':72B 'ai':2A,24A,27B,32B,75B,94C 'ai-tool':26B 'allow':60B,97C 'arbitrari':102C 'changelog':42B 'client':8A,46B,99C 'client-suppli':45B 'counter':67B,87C 'craft':4A,110C 'current':80B 'cve':14A,17A 'data':56B 'databas':13A,107C 'enterpris':71B,91C 'enterprise':22A 'escap':59B 'execut':101C 'fix':68B 'gateway':3A,21A,25A,33B,36B,70B,76B,90C,95C 'host':39B 'inject':62B,82C 'kong':1A,20A,23A,29B,31B,40B,89C,93C,106C 'kong-ai-gateway':30B 'let':7A 'licens':54B 'llm':35B,55B,65B,85C 'llm-gateway':34B 'may':96C 'model':5A,48B,111C 'name':6A,49B,112C 'run':9A 'say':43B 'self':38B 'self-host':37B 'sql':10A,61B,81C,103C 'suppli':47B 'tabl':57B 'tool':28B 'usag':66B,86C 'via':108C 'without':58B 'written':51B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Kong Gateway Enterprise and Kong AI Gateway deployments that count LLM usage (a client-supplied model name is written into the license_llm_data table). A request carrying a crafted model name can run SQL against the Kong database. The CVSS vector says network-reachable with low privileges required, so a valid client credential is probably needed, but Kong's changelog does not say. Teams that do not run Kong Gateway Enterprise or AI Gateway can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:49:18Z","by":"analyst","doc":"https://developer.konghq.com/ai-gateway/changelog/","run_id":2859}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aigateway","gatewayenterprise","kongaigateway","konggatewayenterprise"],"ptokens":["ai","enterprise","gateway","kong"],"labels":["aitooling","high","kong","kongaigateway","llmgateway","selfhosted"],"campaign_type":null,"search_a":"'-2026':15A,18A '-92544':16A,19A 'ai':2A,24A 'client':8A 'craft':4A 'cve':14A,17A 'databas':13A 'enterprise':22A 'gateway':3A,21A,25A 'kong':1A,20A,23A 'let':7A 'model':5A 'name':6A 'run':9A 'sql':10A","search_b":"'2.3.0':77B '2.3.1':78B '3.16.0.2':72B 'ai':27B,32B,75B 'ai-tool':26B 'allow':60B 'changelog':42B 'client':46B 'client-suppli':45B 'counter':67B 'current':80B 'data':56B 'enterpris':71B 'escap':59B 'fix':68B 'gateway':33B,36B,70B,76B 'host':39B 'inject':62B 'kong':29B,31B,40B 'kong-ai-gateway':30B 'licens':54B 'llm':35B,55B,65B 'llm-gateway':34B 'model':48B 'name':49B 'say':43B 'self':38B 'self-host':37B 'sql':61B 'suppli':47B 'tabl':57B 'tool':28B 'usag':66B 'without':58B 'written':51B","search_c":"'ai':94C 'allow':97C 'arbitrari':102C 'client':99C 'counter':87C 'craft':110C 'databas':107C 'enterpris':91C 'execut':101C 'gateway':90C,95C 'inject':82C 'kong':89C,93C,106C 'llm':85C 'may':96C 'model':111C 'name':112C 'sql':81C,103C 'usag':86C 'via':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:21:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92544","severity":null,"published_at":"2026-11-10T21:21:40+00:00","modified_at":"2026-11-10T21:21:40+00:00","first_seen_at":"2026-11-10T21:46:16+00:00","fetched_at":"2026-11-10T21:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92544:2859","url":"https://developer.konghq.com/gateway/changelog/","severity":null,"published_at":"2026-11-10T21:49:18+00:00","modified_at":"2026-11-10T21:49:18+00:00","first_seen_at":"2026-11-10T21:49:18+00:00","fetched_at":"2026-11-10T21:49:18+00:00","note":"Fix read in Kong's own Gateway and AI Gateway changelogs; no standalone advisory page was readable. Auth requirement and older-branch fixed versions (e.g. 3.15.0.7) unconfirmed. No PoC or exploitation found; X not searched.","cites":["https://developer.konghq.com/gateway/changelog/","https://developer.konghq.com/ai-gateway/changelog/"]}],"documents":[{"id":119284,"url":"https://developer.konghq.com/gateway/changelog/","title":"Kong Gateway changelog (3.16.0.2)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119286,"url":"https://developer.konghq.com/ai-gateway/changelog/","title":"Kong AI Gateway changelog","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}