CVE-2026-92544

Name of the Vulnerable Software and Affected Versions Kong Gateway Enterprise (affected versions not specified) Kong AI Gateway (affected versions not specified)

Description An issue exists in the LLM usage counters where a client can execute arbitrary SQL against the database. This occurs because the system writes a client-supplied model string into a usage-counter table without proper escaping. The exploitation occurs via a crafted model name used in an LLM request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.