Four0Four

**Name of the Vulnerable Software and Affected Versions** Kong Gateway versions prior to 3.9.4 **Description** A SQL Injection (SQLi) exists in the clustering communication logic of Kong Gateway (Enterprise and Open Source) when operating in Hybrid Mode. An attacker can trigger this issue by sending specially crafted RPC requests to the Control Plane (CP), which may lead to unauthorized database access. Exploitation requires network access to the Control Plane clustering port and a valid client certificate and key. **Recommendations** Update to version 3.9.4.