CVE-2026-18674highCWE-345CWE-863

CVE-2026-18674: falha de alta gravidade em Kong Mesh

Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

Publicada em

Seguir esta CVE+ Monitorar Kong Mesh

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7epss 0.6%
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone. The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide. The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Kong Inc. · Kong Mesh
CVEs relacionadas — Kong Mesh

No mesmo produto, das mais perigosas para as menos.

CVE-2026-18677MEDIUMKong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identityEPSS 0.6%CVE-2026-18675MEDIUMKong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kidEPSS 0.6%CVE-2026-18673MEDIUMKong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authenticationEPSS 0.5%CVE-2026-18676MEDIUMKong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost adminEPSS 0.3%CVE-2026-18679MEDIUMKong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configuredEPSS 0.2%CVE-2026-18678MEDIUMKong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configuredEPSS 0.1%