{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18675", "assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "state": "PUBLISHED", "assignerShortName": "Kong", "dateReserved": "2026-08-03T15:20:42.168Z", "datePublished": "2026-08-12T18:36:17.377Z", "dateUpdated": "2026-08-12T18:36:17.377Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "shortName": "Kong", "dateUpdated": "2026-08-12T18:36:17.377Z"}, "title": "Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-248", "description": "CWE-248 Uncaught Exception", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-704", "description": "CWE-704 Incorrect Type Conversion or Cast", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of Service"}]}], "affected": [{"vendor": "Kong Inc.", "product": "Kong Mesh", "platforms": ["Linux"], "modules": ["kuma-cp"], "versions": [{"status": "affected", "version": "0", "lessThan": "2.7.29", "versionType": "semver"}, {"status": "affected", "version": "2.8.0", "lessThan": "2.9.19", "versionType": "semver"}, {"status": "affected", "version": "2.10.0", "lessThan": "2.11.18", "versionType": "semver"}, {"status": "affected", "version": "2.12.0", "lessThan": "2.12.14", "versionType": "semver"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.10", "versionType": "semver"}, {"status": "affected", "version": "2.14.0", "lessThan": "2.14.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The dataplane token validator in <code>kuma-cp</code> performs an unchecked Go type assertion on the JWT <code>kid</code> header. A token whose <code>kid</code> is a JSON number decodes as a <code>float64</code> and triggers a runtime panic before any signature, claims, or authorization check runs.</p><p>The panic terminates the entire <code>kuma-cp</code> process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token</p><p>A single request is a transient interruption; sustaining an outage requires repeated requests.</p>"}]}], "references": [{"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8", "name": "Upstream advisory GHSA-5mxq-7xq4-3vx8", "tags": ["vendor-advisory"]}, {"url": "https://github.com/kumahq/kuma/pull/17465", "name": "kumahq/kuma#17465 (master)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17468", "name": "kumahq/kuma#17468 (release-2.14 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17467", "name": "kumahq/kuma#17467 (release-2.13 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17471", "name": "kumahq/kuma#17471 (release-2.12 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17469", "name": "kumahq/kuma#17469 (release-2.11 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17470", "name": "kumahq/kuma#17470 (release-2.9 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17472", "name": "kumahq/kuma#17472 (release-2.7 backport)", "tags": ["patch"]}, {"url": "https://developer.konghq.com/mesh/changelog/", "name": "Kong Product Security Advisories", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "configurations": [{"lang": "en", "value": "You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\n\n\n\nYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.</p><p>You are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.</p>"}]}], "workarounds": [{"lang": "en", "value": "Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string kid header and the dataplane server recovers from handler panics.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string <code>kid</code> header and the dataplane server recovers from handler panics.</p>"}]}], "timeline": [{"time": "2026-08-01T16:58:00.000Z", "lang": "en", "value": "Kong Mesh patched releases published"}], "credits": [{"lang": "en", "value": "https://hackerone.com/0ricky", "type": "finder"}], "source": {"discovery": "EXTERNAL"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["kuma-cp"], "platforms": ["Linux"], "product": "Kong Mesh", "vendor": "Kong Inc.", "versions": [{"lessThan": "2.7.29", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2.9.19", "status": "affected", "version": "2.8.0", "versionType": "semver"}, {"lessThan": "2.11.18", "status": "affected", "version": "2.10.0", "versionType": "semver"}, {"lessThan": "2.12.14", "status": "affected", "version": "2.12.0", "versionType": "semver"}, {"lessThan": "2.13.10", "status": "affected", "version": "2.13.0", "versionType": "semver"}, {"lessThan": "2.14.2", "status": "affected", "version": "2.14.0", "versionType": "semver"}]}], "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests."}], "id": "CVE-2026-18675", "lastModified": "2026-08-12T19:17:30.650", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "type": "Secondary"}]}, "published": "2026-08-12T19:17:30.650", "references": [{"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://developer.konghq.com/mesh/changelog/"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17465"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17467"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17468"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17469"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17470"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17471"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17472"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8"}], "sourceIdentifier": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}, {"lang": "en", "value": "CWE-704"}], "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "type": "Secondary"}]}

{}

{}