Vulnerability in Kong Inc. Mesh
CVE-2026-18679
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connect…
Vulnerability class: Improper Certificate Validation
Affected products
- Kong Inc. Mesh — versions 0, 2.8.0, 2.10.0
Weakness classification (CWE)
References
- 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb (vendor-advisory)
- 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb (patch)
- 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb (release-notes)