CVE-2026-18673— Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
Possible ATT&CK Techniques 2AI
T1592 · Gather Victim Host Information T1083 · File and Directory DiscoveryGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18673
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
Source: CVE Program / CVE List V5
Vulnerability Description
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-18673
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18673
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-18673 (3)
- 🔗 Kong Mesh changelog - Kong Mesh | Kong Docsvendor-advisory
Vendor Advisories for CVE-2026-18673 (1)
Same Patch Batch · Kong Inc. · 2026-08-12 · 6 CVEs total
| CVE-2026-18677 | 6.0 MEDIUM | Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE id |
| CVE-2026-18679 | 5.8 MEDIUM | Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate whe |
| CVE-2026-18678 | 5.5 MEDIUM | Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate whe |
| CVE-2026-18675 | 5.3 MEDIUM | Kong Mesh: control plane denial of service via a malformed dataplane token with a non-stri |
| CVE-2026-18676 | 5.1 MEDIUM | Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wild |
IV. Related Vulnerabilities
Same product: Kong Mesh
- CVE-2026-18679
Kong Mesh: kuma-dp connects to the control plane without ver - CVE-2026-18678
Kong Mesh: kumactl connects to the control plane without ver - CVE-2026-18677
Kong Mesh: a dataplane token without a workload binding can - CVE-2026-18676
Kong Mesh: default control plane config leaks the admin toke - CVE-2026-18675
Kong Mesh: control plane denial of service via a malformed d
Same vendor: Kong Inc.
- CVE-2026-18679
Kong Mesh: kuma-dp connects to the control plane without ver - CVE-2026-18678
Kong Mesh: kumactl connects to the control plane without ver - CVE-2026-18677
Kong Mesh: a dataplane token without a workload binding can - CVE-2026-18676
Kong Mesh: default control plane config leaks the admin toke - CVE-2026-18675
Kong Mesh: control plane denial of service via a malformed d
Same weakness: CWE-200
- CVE-2026-72804
SiYuan before v3.7.4 Authentication Bypass via Graph Endpoin - CVE-2026-73406
Budibase: Unauthenticated user information disclosure via pu - CVE-2026-73308
Budibase: OAuth2 Token Disclosure via Automation Test Result - CVE-2026-54183
Apache Airflow: Airflow Variables were not masked in the UI - CVE-2026-65017
Apache Airflow: Config API: team-scoped Celery broker secret
V. Comments for CVE-2026-18673
No comments yet