CVE-2026-13341 Overview
CVE-2026-13341 is an input validation vulnerability [CWE-20] in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0. A remote attacker can craft content that triggers an indirect prompt injection, causing the MCP server to execute unintended API requests on behalf of the connected AI agent. Exploitation requires user interaction with attacker-controlled data and produces a scope change, exposing sensitive information reachable through the Konnect control plane. The issue is tracked in the Kong mcp-konnect GitHub Security Advisory GHSA-7767-3m3w-2p44.
Critical Impact
An attacker can hijack an AI agent's MCP session to invoke Kong Konnect API operations the user never intended, resulting in high-impact confidentiality loss.
Affected Products
- Kong Konnect Model Context Protocol (MCP) server (mcp-konnect)
- All releases prior to version 1.0.0
- AI agent integrations that consume the Kong Konnect MCP server
Discovery Timeline
- 2026-07-03 - CVE-2026-13341 published to the National Vulnerability Database
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-13341
Vulnerability Analysis
The Kong Konnect MCP server exposes Kong Konnect control plane operations to AI agents through the Model Context Protocol. When the server relays external content, such as API responses, documentation, or resource metadata, back to the language model, it does not sufficiently distinguish that content from trusted operator instructions. An attacker who controls any string surfaced through the MCP server can embed adversarial instructions that the model interprets as directives. The model then invokes MCP tools that map to Kong Konnect API endpoints, executing calls the operator never authorized.
The advisory classifies the flaw under [CWE-20] Improper Input Validation. The scope change reflected in the CVSS vector indicates that the vulnerable MCP process influences a separate security authority, namely the Konnect tenant reachable through the authenticated session. Impact is limited to confidentiality, because the API operations exposed by the MCP server primarily read Konnect resources.
Root Cause
The root cause is the absence of a trust boundary between untrusted third-party content returned by tools and the instruction channel consumed by the LLM. Downstream text is treated as data by developers, but as instructions by the model, allowing prompt injection to translate into unintended tool invocations.
Attack Vector
Exploitation is network-based and requires the victim to interact with attacker-influenced content, for example a poisoned API description, a malicious document ingested by the agent, or a manipulated Konnect object. Once the LLM ingests the payload, it issues MCP tool calls to enumerate services, routes, consumers, or credentials accessible through the authenticated Konnect session. Refer to the Kong MCP Konnect Security Advisory GHSA-7767-3m3w-2p44 for vendor technical detail.
Detection Methods for CVE-2026-13341
Indicators of Compromise
- MCP tool invocations that do not correlate with a preceding user prompt in agent transcripts.
- Sudden bursts of Konnect API read operations sourced from an MCP server session, especially against consumers, credentials, or services endpoints.
- LLM output containing embedded directive strings such as "ignore previous instructions" originating from tool responses.
Detection Strategies
- Log every MCP tool call with the originating user prompt, the tool name, and the resulting Konnect API request, then alert on tool calls issued without a matching user intent.
- Parse content returned by MCP resources for prompt-injection patterns before it reaches the model, and flag matches for review.
- Compare Konnect audit logs against agent session transcripts to identify API calls that lack a corresponding operator request.
Monitoring Recommendations
- Forward Kong Konnect audit logs and MCP server logs to a centralized analytics platform and retain them for post-incident review.
- Baseline normal MCP tool usage per user and alert on deviations in call frequency, target resource type, or time of day.
- Monitor outbound Konnect API traffic volume from the MCP server host for anomalies indicating automated enumeration.
How to Mitigate CVE-2026-13341
Immediate Actions Required
- Upgrade the Kong Konnect MCP server (mcp-konnect) to version 1.0.0 or later on every host that runs it.
- Rotate any Konnect personal access tokens or system account credentials used by MCP server deployments that ran a vulnerable version.
- Review Konnect audit logs for the exposure window to identify unexpected read operations issued through MCP sessions.
Patch Information
Kong published the fix in mcp-konnect version 1.0.0. Consult the Kong MCP Konnect GHSA-7767-3m3w-2p44 advisory for the exact patched release and upgrade procedure.
Workarounds
- Restrict the Konnect API scope granted to the MCP server's credentials to the minimum required, removing write permissions where feasible.
- Require explicit human confirmation in the AI agent before any MCP tool invocation is dispatched to Konnect.
- Sanitize or tag content returned from MCP tools so downstream models treat it as untrusted data rather than instructions.
- Isolate the MCP server on a network segment that only reaches the Konnect endpoints it must call.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
