CVE Feed

    Dashboard / CVE / CVE-2026-18679

    CVE-2026-18679

    When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.

    Published:Aug 12, 2026
    Last Modified:Aug 13, 2026
    EPS:Aug 12, 2026
    EPSS Score:0.00119
    CVSS Score:5.8

    Affected Products

    Vendor
    Konghq
    Product
    Kong Mesh

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2026-18674 (CVSS 7) — On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using …
    CVE-2026-18678 (CVSS 5.5) — When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl di…
    CVE-2026-18677 (CVSS 6) — In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the data…
    CVE-2026-18676 (CVSS 5.1) — The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpa…
    CVE-2026-18675 (CVSS 5.3) — The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A toke…
    CVE-2026-18673 (CVSS 5.3) — When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readine…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High