Kong Connect MCP Stored Prompt Injection and Credential Exposure (GHSA-7767-3m3w-2p44)

Kong mcp-connect Stored Prompt Injection and Credential Exposure Vulnerability Vulnerability Overview Vulnerability Name: Stored Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Connect MCP Vulnerability ID: GHSA-7767-3m3w-2p44 Severity: High (CVSS 7.4 / 10) Publication Date: May 16, 2024 Reporter: johnbarratt85 Affected Versions Affected Versions: < 1.0.0 Fixed Version: 1.0.0 Impact Description: - Users utilizing analytics tools to retrieve request data from the gateway may be affected if malicious attackers can send traffic to the gateway, and the MCP client or AI agent renders or operates on the returned content without sufficient sandboxing or outbound network restrictions. - Remote attackers can forge request metadata, such as the , causing data to be stored in Kong analytics. When the MCP server returns data to the AI assistant, insufficient sandboxing may cause the assistant to interpret the content as instructions or executable tags. In affected configurations, if the MCP client or agent is permitted to fetch remote resources or make outbound requests based on model output, this may lead to sensitive information leakage to attacker-controlled URLs. - Certain configurations may expose secrets or sensitive configuration values returned by other MCP tools, including plugin configuration data, internal hostnames, or other operational metadata. - Related issues also allow for path manipulation within specific control planes and group identifiers, potentially causing the MCP server to request unintended Kong API endpoints using the user's token. Remediation Patch: - A fix is prepared in version v1.0.0. - Remediation measures include: - Sandboxing potentially untrusted analytics fields before returning data to tool output. - Validating control plane and group identifiers as UUIDs. - Encoding path segments and pagination query values before constructing Kong API requests. - Disabling raw plugin configuration output by default, requiring explicit tool options and server-side policy options before returning raw plugin configuration. - Users should upgrade to the latest patched version as soon as possible. - Note: Sensitive values may be intentionally returned when raw plugin configuration is explicitly enabled via server policy. Operators should keep raw plugin configuration disabled unless strictly necessary. Workarounds If immediate upgrading is not possible, the following measures can be taken: - Avoid using analytics tools against gateways that accept untrusted public traffic. - Do not enable raw plugin configuration output. - Restrict or sandbox AI agents and MCP clients so that their tool outputs do not automatically trigger remote fetches or arbitrary outbound network requests. - Disable automatic rendering of remote content or model-generated links where possible. - Apply outbound rules preventing local development tools and runtimes from accessing untrusted external hosts. - Treat analytics-generated text as untrusted input; avoid instructing the assistant to "complete," "fill," or enrich suspicious or partial values using other configuration sources. - Appropriate sandboxing and MCP client hardening can reduce the severity of this issue. Clients should not automatically render returned content, follow model-generated links, or allow unrestricted outbound network access based on tool output. Requiring user approval for external fetches and restricting outbound connections to trusted destinations can help prevent data leakage to untrusted URLs, even when untrusted content is retrieved. Credits Reporter: Eli Ainhorn, Senior AI Vulnerability Researcher @ Noma Security

Goal Reached Thanks to every supporter — we hit 100%!

Kong Connect MCP Stored Prompt Injection and Credential Exposure (GHSA-7767-3m3w-2p44)

More from this source