Kong Konnect MCP server vulnerable to stored prompt injection via untrusted analytics data
Kong·Kong Konnect Model Context Protocol (MCP) serverFixed
A remote attacker could craft request metadata (e.g. the User-Agent header) that got stored in Konnect gateway analytics; when an AI agent queried the MCP server's analytics tools, the server returned this attacker-controlled text unsanitized, letting it be interpreted as instructions by the model. A related path-manipulation flaw in control-plane and group identifiers let the MCP server be tricked into calling unintended Konnect API endpoints using the user's own token.
- Blast radius
- In client environments that allowed the agent to make outbound fetches or render remote content based on model output, this could exfiltrate secrets and sensitive configuration returned by other MCP tools (including plugin configuration data) and internal hostnames to an attacker-controlled URL; no specific victim organisation or exploitation-in-the-wild was disclosed.
- Root cause
- The MCP server treated attacker-influenced analytics fields as trusted tool output and returned them to the LLM without neutralization, combined with insufficiently validated control-plane/group identifiers that allowed path manipulation in constructed API requests.
- How it was caught
- Found and reported by an external security researcher (Eli Ainhorn of Noma Security) rather than through Kong's own monitoring; disclosed responsibly via GitHub Security Advisories.
- What changed
- Kong shipped MCP server v1.0.0, which neutralizes untrusted analytics fields before returning them in tool output, validates control-plane/group identifiers as UUIDs, encodes path segments and query values before building API requests, and disables raw plugin configuration output by default (requiring explicit opt-in).
Take-awayNever let an MCP/agent tool return attacker-influenceable stored data (like logged request headers) to a model without sanitization, and gate any agent-initiated outbound network requests behind explicit user approval and egress allowlists.