CVE-2026-13341 describes a high-severity security issue in Kong’s Konnect MCP server before version 1.0.0. The Kong security advisory says untrusted data returned through analytics tools could be interpreted as instructions or renderable content by an MCP client or AI agent that lacked sufficient isolation. The advisory also describes related input-validation and request-construction issues that could lead to unintended Konnect API requests. This is a source-linked report of the published record, not evidence that every Kong Konnect deployment is exposed or compromised.
What the advisory reports
The affected component is the mcp-konnect server used to interact with Kong Konnect APIs. According to the maintainer advisory, a remote actor could place crafted request metadata, such as a User-Agent value, into traffic that was later visible through gateway analytics. When an MCP server returned that data to an assistant, an insufficiently constrained client could treat it as model-directed content rather than untrusted data.
The reported consequence depends on the surrounding client and agent policy. If model output could trigger outbound requests or retrieve remote resources without an approval step, the advisory says sensitive information could be disclosed to an attacker-controlled destination. It specifically discusses possible exposure of secrets or configuration returned by other MCP tools, as well as internal hostnames and operational metadata. MCPwatch did not reproduce the issue or assess a particular tenant.
Additional request-boundary concerns
The advisory also describes path-manipulation concerns involving control-plane and group identifiers. In affected code paths, malformed identifiers could cause requests to be constructed for unintended Konnect API endpoints using the caller’s token. The maintainer’s remediation includes UUID validation and encoding of path segments and pagination or query values. These details are important because the record is not limited to a prompt-rendering problem: tool-output handling and API request construction both form part of the security boundary.
NVD lists CVE-2026-13341 as awaiting NVD enrichment and records the CNA-provided CVSS 3.1 score of 7.4 (High), with user interaction required and changed scope. That score is attributed to Kong in the NVD record; it is not an independent MCPwatch assessment. The NVD description is concise, so readers should use the maintainer advisory for the configuration and impact conditions.
Who should review exposure
Operators should prioritize environments where the MCP server can query analytics from gateways that accept untrusted public traffic, where agents can follow links or make external requests automatically, or where raw plugin configuration output has been enabled. The practical risk depends on the MCP client, model-agent policy, egress controls, and the permissions of the Konnect token. A network-reachable analytics source alone does not establish credential disclosure.
Review the server version, the client or agent’s treatment of tool output, whether remote content is rendered automatically, and which Konnect permissions the token holds. Also document whether the server can reach arbitrary external hosts. These checks separate the vulnerability record from deployment-specific impact and help teams choose a proportionate response.
Recommended response
- Upgrade. Move to the latest supported
mcp-konnectrelease, including version 1.0.0 or later, and verify the running deployment rather than only a source checkout or container tag. - Keep raw plugin configuration disabled. The advisory says the patched behavior requires explicit tool and server-policy opt-in for raw plugin configuration. Leave that output disabled unless the operational need is documented.
- Constrain agent behavior. Require approval for external fetches, disable automatic rendering of remote content where possible, and apply egress controls that limit destinations to those required by the deployment.
- Review permissions and logs. Inventory the token permissions used by the MCP server and look for unexpected analytics-driven requests, external destinations, configuration reads, or access outside the intended control plane and group scope.
- Treat analytics text as untrusted. Do not ask an assistant to enrich or complete suspicious values using unrelated configuration sources, and preserve relevant evidence before changing logging or access settings.
What this record does not establish
The CVE and maintainer advisory do not establish exploitation of a named organization, compromise of a particular Konnect account, or impact to installations that use a patched release and restrictive agent policy. They also do not make every analytics value malicious. The relevant question is whether untrusted fields can cross into an agent action path without neutralization, approval, sandboxing, or egress controls.
Sources and related coverage
Read the Kong security advisory for affected and patched versions, impact conditions, remediation details, and workarounds. The NVD CVE-2026-13341 record provides the public identifier and CNA-attributed severity data. Consult the project’s release materials when verifying an upgrade. Related source-linked reporting is available in the MCPwatch CVE and incident watch.