A vulnerability exists in the Kong Konnect Model Context Protocol

CVE-2026-13341 lives in the Kong Konnect Model Context Protocol (MCP) server — a TypeScript shim that developers install locally so Claude, Cursor, or another LLM client can query their Konnect org, inspect gateway configs, and pull analytics. Improper input validation (CWE-20) on data returned from Konnect / user-supplied prompts allows an attacker who controls text the MCP server ingests (an injected log line, a poisoned route description, a document the AI is told to summarize) to steer the assistant into exfiltrating session context — hence the S:C / C:H / I:N / A:N CVSS shape. Affects all mcp-konnect releases prior to 1.0.0; the repo is now archived and Kong redirects users to the hosted Konnect remote MCP server.

Vendor rated this HIGH (7.4) on the strength of AV:N / AC:L / PR:N / UI:R plus scope change. That math is defensible in isolation but ignores deployment reality: this component runs as a local developer utility, not as an internet-reachable gateway. The blast radius is one developer's Konnect PAT and whatever tenant that PAT can see — real, but not fleet-scale. HIGH overstates the aggregate enterprise risk; MEDIUM is the honest read.

Why this verdict

• User interaction required — the chain only fires when a developer voluntarily runs an AI query touching poisoned data. This kills mass-exploitation scenarios.
• Local developer utility, not a listener — no internet exposure, no Shodan/Censys population, nothing for GreyNoise to see. Attackers can't sweep for it.
• Role multiplier: mcp-konnect is not deployed on domain controllers, hypervisors, backup, PAM, CI/CD, or edge appliances. Its canonical role is *developer workstation*, blast radius = one PAT's tenant scope. No high-value-role deployment exists → no floor to CRITICAL/HIGH.
• Prereq compromise stage — attacker must already have write access to a Konnect object the victim will query, i.e. same tenant or a federated relationship. This is post-initial-access territory.
• Deprecated component + easy migration path — Kong's remote hosted MCP replaces this shim. Enterprises can eliminate the exposure by uninstall, not just patch.

Why not higher?

HIGH would be defensible only if this were the hosted Konnect control plane or the API gateway data plane. It isn't — it's an archived TypeScript helper for LLM clients. The UI:R gate, the localhost-only listener footprint, and the absence of any KEV/EPSS/exploit signal all argue against HIGH. Reserving HIGH for issues that touch the gateway itself keeps the queue honest.

Why not lower?

LOW understates real impact: successful exploitation yields a valid Konnect PAT, which can pivot to gateway config changes and traffic manipulation on that tenant. Prompt-injection against tool-using LLMs is a *known-working* attack class in 2026, not theoretical. MEDIUM reflects a real but bounded risk.

1. Uninstall local mcp-konnect from all developer endpoints — The upstream is archived. Removing the package eliminates the vulnerable code entirely — cleaner than patching a dead project. Push via MDM/Jamf/Intune package removal. Target completion: within the 365-day noisgate remediation window, but there is no reason to wait — do it this sprint.
2. Rotate every Konnect PAT that was ever used with mcp-konnect — Assume any PAT wired into a local LLM client is potentially compromised. Force rotation via Konnect's PAT management API and require re-issuance with minimum-scope grants. Complete within 30 days as backlog hygiene, sooner if any developer's endpoint shows anomalous outbound flow.
3. Migrate developers to Kong's hosted remote MCP server — Kong's replacement runs in the Konnect control plane with proper input handling. Onboard developer teams over the next 60–90 days; document the new client configuration in your dev-tooling wiki.
4. Enforce EDR outbound-connection telemetry on IDE and Node processes — Prompt-injection exfil typically egresses via node, code, or cursor processes to novel hosts. Alert on first-seen destinations from those parent binaries — catches this and adjacent MCP bugs you don't have CVEs for yet.
5. Scope Konnect PATs to read-only + single workspace where possible — Bounds blast radius even if a token leaks. Combine with short PAT TTLs (≤90d) enforced by policy.

Run on each developer workstation (macOS/Linux) or via your MDM as the logged-in user. Example: bash check-mcp-konnect.sh. No elevated privileges required — the tool is installed per-user via npm/npx. For Windows dev boxes, translate the npm ls block to PowerShell.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-13341 — Kong Konnect MCP server input validation
# Exit codes: 0 PATCHED | 1 VULNERABLE | 2 UNKNOWN
set -u

FIXED_MAJOR=1
FIXED_MINOR=0
FIXED_PATCH=0
FOUND=0
VULN=0

check_version() {
  local v="$1"
  # Strip leading v and any pre-release/build metadata
  v="${v#v}"
  v="${v%%-*}"
  v="${v%%+*}"
  local maj min pat
  maj=$(echo "$v" | cut -d. -f1)
  min=$(echo "$v" | cut -d. -f2)
  pat=$(echo "$v" | cut -d. -f3)
  [[ -z "$maj" || -z "$min" || -z "$pat" ]] && return 2
  if (( maj < FIXED_MAJOR )); then return 1; fi
  if (( maj == FIXED_MAJOR && min < FIXED_MINOR )); then return 1; fi
  if (( maj == FIXED_MAJOR && min == FIXED_MINOR && pat < FIXED_PATCH )); then return 1; fi
  return 0
}

# 1. Global npm install
if command -v npm >/dev/null 2>&1; then
  GLOBAL=$(npm ls -g --depth=0 --json 2>/dev/null | grep -oE '"@kong/mcp-konnect"[^}]*"version":[^,}]*' | head -1 | sed -E 's/.*"version":[[:space:]]*"([^"]+)".*/\1/')
  if [[ -n "${GLOBAL:-}" ]]; then
    FOUND=1
    echo "found global @kong/mcp-konnect@${GLOBAL}"
    check_version "$GLOBAL"
    rc=$?
    (( rc == 1 )) && VULN=1
    (( rc == 2 )) && echo "could not parse version $GLOBAL"
  fi
fi

# 2. Local project installs under $HOME (bounded search)
while IFS= read -r pkg; do
  V=$(grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' "$pkg" | head -1 | sed -E 's/.*"([^"]+)"$/\1/')
  [[ -z "$V" ]] && continue
  FOUND=1
  echo "found $pkg version $V"
  check_version "$V"
  rc=$?
  (( rc == 1 )) && VULN=1
done < <(find "$HOME" -maxdepth 6 -type f -path '*node_modules/@kong/mcp-konnect/package.json' 2>/dev/null)

# 3. Common LLM client config references
for CFG in \
  "$HOME/Library/Application Support/Claude/claude_desktop_config.json" \
  "$HOME/.config/Claude/claude_desktop_config.json" \
  "$HOME/.cursor/mcp.json" \
  "$HOME/.config/cursor/mcp.json"; do
  if [[ -f "$CFG" ]] && grep -q 'mcp-konnect' "$CFG" 2>/dev/null; then
    echo "LLM client config references mcp-konnect: $CFG"
    FOUND=1
  fi
done

if (( VULN == 1 )); then
  echo "VULNERABLE"; exit 1
fi
if (( FOUND == 0 )); then
  echo "UNKNOWN (mcp-konnect not detected — confirm no per-tool npx invocations in LLM configs)"; exit 2
fi
echo "PATCHED"; exit 0

Sources

1. Kong mcp-konnect repository (archived)
2. Kong Konnect MCP Server documentation
3. Kong Gateway vulnerability handling process
4. Kong Inc. CVE Program partner page
5. CWE-20: Improper Input Validation
6. Endor Labs — Classic Vulnerabilities Meet AI Infrastructure (MCP AppSec)
7. Konghq CVEs on OpenCVE
8. CISA KEV Catalog