Vulnerability in Kong Inc. Mesh
CVE-2026-18678
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the opera…
Vulnerability class: Improper Certificate Validation
Affected products
- Kong Inc. Mesh — versions 0, 2.8.0, 2.10.0
Weakness classification (CWE)
References
- 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb (vendor-advisory)
- 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb (patch)
- 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb (release-notes)