---
id: "CVE-2026-92544"
page: "https://infrastack.ai/live/CVE-2026-92544"
kind: "vulnerability"
aliases: ["CVE-2026-92544"]
title: "Kong AI Gateway: crafted model name lets clients run SQL on the database"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Kong Gateway Enterprise", "fixed": ["3.16.0.2"], "affected": "< 3.16.0.2 (older branch ranges unknown)", "ecosystem": "vendor"}, {"name": "Kong AI Gateway", "fixed": ["2.3.0"], "affected": "< 2.3.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-tooling", "kong", "kong-ai-gateway", "llm-gateway", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T21:21:40+00:00"
first_seen_at: "2026-11-10T21:46:16+00:00"
updated_at: "2026-11-10T21:49:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92544", "first_seen_at": "2026-11-10T21:46:16+00:00"}, {"source": "analyst", "url": "https://developer.konghq.com/gateway/changelog/", "first_seen_at": "2026-11-10T21:49:18+00:00", "cites": ["https://developer.konghq.com/gateway/changelog/", "https://developer.konghq.com/ai-gateway/changelog/"]}]
exploit_sources: []
---

# Kong AI Gateway: crafted model name lets clients run SQL on the database

Link for people: https://infrastack.ai/live/CVE-2026-92544 (this .md is for agents)

Kong's changelog says a client-supplied model name was written into the license_llm_data table without escaping, allowing SQL injection from the LLM usage counters. Fixed in Gateway Enterprise 3.16.0.2 and in AI Gateway 2.3.0 (2.3.1 is current).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kong Gateway Enterprise affected < 3.16.0.2 (older branch ranges unknown) fixed 3.16.0.2
- vendor:Kong AI Gateway affected < 2.3.0 fixed 2.3.0

## How to check

Run 'kong version' (or check the image tag) on every Kong Gateway Enterprise and Kong AI Gateway node. Below 3.16.0.2 on Gateway or below 2.3.0 on AI Gateway means the unescaped model name is written to the license_llm_data table. Affected ranges for older branches are not published in the pages read; check Kong's security advisories page for them.

## Fix

Kong Gateway Enterprise: upgrade to 3.16.0.2 (released 2026-11-10); the 3.15.x branch got a 3.15.0.7 release the same day, but its changelog entry for this CVE was not seen, so confirm it lists CVE-2026-92544. Kong AI Gateway: the fix is listed in the 2.3.0 release (2026-11-04) per the vendor changelog; use 2.3.1 (2026-11-10) or later. Fix escapes every value before the usage counter SQL statement runs.

## Timeline

- 2026-11-10T21:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92544
- 2026-11-10T21:49:18+00:00 analyst https://developer.konghq.com/gateway/changelog/ — Fix read in Kong's own Gateway and AI Gateway changelogs; no standalone advisory page was readable. Auth requirement and older-branch fixed versions (e.g. 3.15.0.7) unconfirmed. No PoC or exploitation found; X not searched.

## Documents

- [fix] Kong Gateway changelog (3.16.0.2) https://developer.konghq.com/gateway/changelog/
- [fix] Kong AI Gateway changelog https://developer.konghq.com/ai-gateway/changelog/

## From the sources

SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_