Which Kong releases fix CVE-2026-92544?

Kong fixed CVE-2026-92544 in Kong AI Gateway 2.2.1 and in Kong Gateway Enterprise 3.16.0.2 and 3.15.0.7, all released on November 10, 2026. Kong AI Gateway 2.3.0, released on November 4, carries the same SQL injection fix in the LLM usage counters, although its changelog entry does not print the CVE id.

Do I need an admin account to exploit the Kong model name flaw?

No. The CVSS v4.0 vector for CVE-2026-92544 sets privileges required to low, so an attacker needs whatever credential the gateway asks of a normal API client rather than administrator access. Attack vector is network and user interaction is none, which means any client permitted to proxy an LLM request can place SQL in the model field.

What does the SQL injection in Kong's LLM usage counters reach?

The injected statement runs against the Kong database, which holds gateway configuration as well as the license_llm_data table that records model usage. The published score marks confidentiality, integrity and availability impact as high on the gateway itself, and adds a further high confidentiality impact on systems beyond it.

How can I tell whether my Kong gateway was attacked through the model name?

Kong's changelog entry for CVE-2026-92544 gives no indicators of compromise and reports no exploitation. Operators can still check their own proxy logs for requests whose model field carries SQL syntax such as quotes or semicolons, and compare the Kong database against a known-good backup taken before November 10, 2026.

HIGHVulnerability

Kong AI Gateway: a model name in a request runs SQL on the database

Kong AI Gateway built its usage-counter SQL by pasting in the model name a client sent with the request.

November 10, 2026 · Kong · Research by Kong

CVE-2026-92544

HIGHVulnerability

Kong AI Gateway wrote a client-supplied model name into its LLM usage counters without escaping, so a crafted name runs arbitrary SQL against the Kong database. The advisory scores it CVSS 8.7, and Kong shipped fixes on November 10, 2026.

01What happened

CVE-2026-92544 was published on November 10, 2026, and Kong released the fixes the same day. The flaw sits in the LLM usage counters shared by Kong AI Gateway and Kong Gateway Enterprise. Kong's changelog describes it as SQL injection reachable through a client-supplied model name.

02How it works

Each proxied request writes a row to the license_llm_data table, and the model name taken from the client went into that statement without escaping. A caller who puts SQL syntax in the model field therefore runs statements of their choosing against the Kong database. Kong's fix escapes every value before the statement is run.

03Who is affected

Operators who route LLM traffic through Kong AI Gateway or Kong Gateway Enterprise are exposed. The CVSS v4.0 vector sets attack vector to network, privileges required to low and user interaction to none, so any client allowed to proxy a request can reach the counter. Fixed releases are listed below.

04What to do

Upgrade Kong AI Gateway to 2.2.1 or later, and Kong Gateway Enterprise to 3.16.0.2 or 3.15.0.7. Review the Kong database for rows or schema changes you cannot account for if untrusted clients could reach the gateway before the upgrade.

Questions people ask

Which Kong releases fix CVE-2026-92544?: Kong fixed CVE-2026-92544 in Kong AI Gateway 2.2.1 and in Kong Gateway Enterprise 3.16.0.2 and 3.15.0.7, all released on November 10, 2026. Kong AI Gateway 2.3.0, released on November 4, carries the same SQL injection fix in the LLM usage counters, although its changelog entry does not print the CVE id.
Do I need an admin account to exploit the Kong model name flaw?: No. The CVSS v4.0 vector for CVE-2026-92544 sets privileges required to low, so an attacker needs whatever credential the gateway asks of a normal API client rather than administrator access. Attack vector is network and user interaction is none, which means any client permitted to proxy an LLM request can place SQL in the model field.
What does the SQL injection in Kong's LLM usage counters reach?: The injected statement runs against the Kong database, which holds gateway configuration as well as the license_llm_data table that records model usage. The published score marks confidentiality, integrity and availability impact as high on the gateway itself, and adds a further high confidentiality impact on systems beyond it.
How can I tell whether my Kong gateway was attacked through the model name?: Kong's changelog entry for CVE-2026-92544 gives no indicators of compromise and reports no exploitation. Operators can still check their own proxy logs for requests whose model field carries SQL syntax such as quotes or semicolons, and compare the Kong database against a known-good backup taken before November 10, 2026.

Sources 3 links, all fetched

1github.comGitHub Advisory
2developer.konghq.comAI Gateway Changelog
3developer.konghq.comGateway Changelog