Kong Konnect MCP Server Indirect Prompt Injection Vulnerability

Technical Analysis

The MCP server exposes tool/resource content (likely API responses, documentation, or other external data) to the connected LLM agent without adequate sanitization or trust boundaries. An attacker can embed malicious instructions within this content; when the agent ingests it as part of its context, the injected instructions are interpreted as legitimate commands rather than data, causing the agent to invoke MCP tools and issue API requests the user never authorized. This crosses the trust boundary between untrusted external data and the agent's privileged tool-execution layer, since the MCP server does not adequately distinguish between data and instructions before passing content into the model's context. The attacker gains the ability to trigger arbitrary API calls scoped to whatever permissions the Konnect MCP integration holds, potentially including data exfiltration, configuration changes, or unauthorized API operations.

Affected Systems

Kong Konnect MCP server; protocols: MCP

Detection Signatures

• Monitor MCP tool-call logs for API requests immediately following ingestion of external/untrusted content (e.g., fetched documents, webhook payloads, third-party API responses)
• Flag anomalous or out-of-policy API calls issued by the agent shortly after retrieving tool/resource results containing embedded natural-language instructions
• Inspect tool/resource descriptions and returned content for suspicious imperative phrasing (e.g., 'ignore previous instructions', 'call the following endpoint', 'as system administrator')
• Alert on MCP server responses where returned content size or structure deviates from expected schema, suggesting payload smuggling

Remediation Steps

1. 1

   Upgrade Kong Konnect MCP server

   Update to version 1.0.0 or later, which contains the fix for this indirect prompt injection vulnerability.

2. 2

   Enforce input/output sanitization

   Sanitize and clearly delimit all external content passed through the MCP server before it enters the LLM's context, tagging it as untrusted data rather than instructions.

3. 3

   Apply least-privilege API scoping

   Restrict the API credentials and scopes available to the MCP server so that even a successful injection cannot escalate to sensitive or destructive operations.

4. 4

   Add human-in-the-loop confirmation

   Require explicit user approval for state-changing or sensitive API requests triggered by the agent, especially those derived from external content.

5. 5

   Deploy prompt injection detection

   Implement content-scanning or classifier-based detection on tool outputs and resource content to identify injected instructions before they reach the model.