Kong Inc. Kong Mesh
7 CVEs affecting Kong Inc. Kong Mesh. Latest disclosed: 2026-08-17. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18674 | | 2026-08-17 | On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Ident… | |
CVE-2026-18679 | | 2026-08-12 | When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disab… | |
CVE-2026-18678 | | 2026-08-12 | When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over… | |
CVE-2026-18677 | | 2026-08-12 | In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authentic… | |
CVE-2026-18676 | | 2026-08-12 | The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is… | |
CVE-2026-18675 | | 2026-08-12 | The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64… | |
CVE-2026-18673 | | 2026-08-12 | When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interf… |