{
 "id": "AIR-2026-1151",
 "slug": "kong-konnect-mcp-server-indirect-prompt-injection-vulnerabil",
 "title": "Kong Konnect MCP Server Indirect Prompt Injection Vulnerability",
 "summary": "A vulnerability in the Kong Konnect Model Context Protocol server prior to version 1.0.0 allows remote attackers to execute indirect prompt injections. This flaw can lead to unauthorized API requests being performed through the server.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "prompt_injection"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Kong Konnect MCP server"
 ],
 "incident_date": "2026-07-03",
 "incident_date_precision": "day",
 "first_reported": "2026-07-03",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13341",
   "publisher": "NVD",
   "title": "CVE-2026-13341: A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote…",
   "published_at": "2026-07-03"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-13341",
  "mcp",
  "indirect-prompt-injection"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}