CVE Feed

    Dashboard / CVE / CVE-2026-18677

    CVE-2026-18677

    In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.

    Published:Aug 12, 2026
    Last Modified:Aug 13, 2026
    EPS:Aug 12, 2026
    EPSS Score:0.00313
    CVSS Score:6

    Affected Products

    Vendor
    Konghq
    Product
    Kong Mesh

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-18674 (CVSS 7) — On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using …
    CVE-2026-18679 (CVSS 5.8) — When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the dat…
    CVE-2026-18678 (CVSS 5.5) — When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl di…
    CVE-2026-18676 (CVSS 5.1) — The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpa…
    CVE-2026-18675 (CVSS 5.3) — The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A toke…
    CVE-2026-18673 (CVSS 5.3) — When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readine…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High