# Kong AI Gateway: a model name in a request runs SQL on the database

> Kong AI Gateway built its usage-counter SQL by pasting in the model name a client sent with the request.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** Kong
- **Disclosed:** 2026-11-10
- **CVE:** CVE-2026-92544
- **CVSS:** 8.7
- **Affects:** Kong AI Gateway, Kong Gateway Enterprise
- **Research by:** Kong
- **Primary source:** https://github.com/advisories/GHSA-jvch-w6fx-vccj
- **Page:** https://theinjection.dev/items/kong-ai-gateway-llm-counter-sqli/

Kong AI Gateway wrote a client-supplied model name into its LLM usage counters without escaping, so a crafted name runs arbitrary SQL against the Kong database. The advisory scores it CVSS 8.7, and Kong shipped fixes on November 10, 2026.

## What happened

CVE-2026-92544 was published on November 10, 2026, and Kong released the fixes the same day. The flaw sits in the LLM usage counters shared by Kong AI Gateway and Kong Gateway Enterprise. Kong's changelog describes it as SQL injection reachable through a client-supplied model name.

## How it works

Each proxied request writes a row to the license_llm_data table, and the model name taken from the client went into that statement without escaping. A caller who puts SQL syntax in the model field therefore runs statements of their choosing against the Kong database. Kong's fix escapes every value before the statement is run.

## Who is affected

Operators who route LLM traffic through Kong AI Gateway or Kong Gateway Enterprise are exposed. The CVSS v4.0 vector sets attack vector to network, privileges required to low and user interaction to none, so any client allowed to proxy a request can reach the counter. Fixed releases are listed below.

## What to do

Upgrade Kong AI Gateway to 2.2.1 or later, and Kong Gateway Enterprise to 3.16.0.2 or 3.15.0.7. Review the Kong database for rows or schema changes you cannot account for if untrusted clients could reach the gateway before the upgrade.

## Quick facts

- **Affected:** Kong AI Gateway and Kong Gateway Enterprise, in the LLM usage counters
- **Fixed in:** Kong AI Gateway 2.2.1, Kong Gateway Enterprise 3.16.0.2 and 3.15.0.7, all released November 10, 2026
- **CVE:** CVE-2026-92544
- **CVSS:** 8.7 CVSS v4.0, published with the advisory
- **Attack type:** SQL injection through a client-supplied model name
- **Disclosed:** November 10, 2026

## Questions

### Which Kong releases fix CVE-2026-92544?

Kong fixed CVE-2026-92544 in Kong AI Gateway 2.2.1 and in Kong Gateway Enterprise 3.16.0.2 and 3.15.0.7, all released on November 10, 2026. Kong AI Gateway 2.3.0, released on November 4, carries the same SQL injection fix in the LLM usage counters, although its changelog entry does not print the CVE id.

### Do I need an admin account to exploit the Kong model name flaw?

No. The CVSS v4.0 vector for CVE-2026-92544 sets privileges required to low, so an attacker needs whatever credential the gateway asks of a normal API client rather than administrator access. Attack vector is network and user interaction is none, which means any client permitted to proxy an LLM request can place SQL in the model field.

### What does the SQL injection in Kong's LLM usage counters reach?

The injected statement runs against the Kong database, which holds gateway configuration as well as the license_llm_data table that records model usage. The published score marks confidentiality, integrity and availability impact as high on the gateway itself, and adds a further high confidentiality impact on systems beyond it.

### How can I tell whether my Kong gateway was attacked through the model name?

Kong's changelog entry for CVE-2026-92544 gives no indicators of compromise and reports no exploitation. Operators can still check their own proxy logs for requests whose model field carries SQL syntax such as quotes or semicolons, and compare the Kong database against a known-good backup taken before November 10, 2026.

## Sources

1. [GitHub Advisory](https://github.com/advisories/GHSA-jvch-w6fx-vccj)
2. [AI Gateway Changelog](https://developer.konghq.com/ai-gateway/changelog/)
3. [Gateway Changelog](https://developer.konghq.com/gateway/changelog/)