Kong Konnect MCP server: stored prompt injection via analytics data leads to credential/data exfiltration (CVE-2026-13341)

What it is

GitHub Security Advisory GHSA-7767-3m3w-2p44 (CVE-2026-13341) for Kong's mcp-konnect MCP server. The stored-prompt-injection mechanism and the v1.0.0 patch are already covered in the catalog summary; what the advisory adds beyond that is a precise statement of who is actually exposed and a set of workarounds for operators who cannot upgrade immediately.

Preconditions / Affected

The advisory is explicit that impact is conditional, not automatic. Both must hold:

• The analytics tools are used to retrieve request data from a gateway that a malicious actor can send traffic to (i.e. one accepting untrusted public traffic).
• The MCP client or AI agent renders or acts on returned content without sufficient sandboxing or outbound network restrictions — specifically, it can fetch remote resources or make outbound requests based on model output.

The advisory states plainly that proper sandboxing of agents and MCP clients "materially reduces the severity of this issue," and that requiring user approval for external fetches and limiting egress can prevent exfiltration even when untrusted content is retrieved. In other words, the exfiltration leg depends on client-side network posture, not just the server.

What to do

Upgrade to v1.0.0. If you cannot upgrade immediately, the advisory lists workarounds — these are the actionable items the summary omits:

• Avoid using analytics tools against gateways that accept untrusted public traffic.
• Do not enable raw plugin configuration output.
• Restrict or sandbox AI agents/MCP clients so tool output cannot automatically trigger remote fetches or arbitrary outbound requests.
• Disable automatic rendering of remote content or model-generated links.
• Apply egress controls so local dev tools and agent runtimes cannot reach untrusted external hosts.
• Treat analytics-derived text as untrusted; do not ask assistants to "complete," "fill in," or enrich suspicious or partial values using other configuration sources.

Caveats

The raw-plugin-config patch is a defense-in-depth default, not a hard block. Even after upgrading, when raw plugin configuration is explicitly enabled by server policy, sensitive values may still be returned intentionally — and returning raw config now requires both explicit tool opt-in and server-side policy opt-in. The advisory advises leaving raw plugin config disabled unless strictly required. Credit: Eli Ainhorn, Noma Security.