CVE Feed

    Dashboard / CVE / CVE-2026-18678

    CVE-2026-18678

    When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

    Published:Aug 12, 2026
    Last Modified:Aug 13, 2026
    EPS:Aug 12, 2026
    EPSS Score:0.00096
    CVSS Score:5.5

    Affected Products

    Vendor
    Konghq
    Product
    Kong Mesh

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2026-18674 (CVSS 7) — On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using …
    CVE-2026-18679 (CVSS 5.8) — When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the dat…
    CVE-2026-18677 (CVSS 6) — In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the data…
    CVE-2026-18676 (CVSS 5.1) — The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpa…
    CVE-2026-18675 (CVSS 5.3) — The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A toke…
    CVE-2026-18673 (CVSS 5.3) — When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readine…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High