CVE-2026-18675— Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18675
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid
Source: CVE Program / CVE List V5
Vulnerability Description
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-18675
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18675
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-18675 (8)
- 🔗 Kong Mesh changelog - Kong Mesh | Kong Docsrelease-notes
Vendor Advisories for CVE-2026-18675 (1)
Same Patch Batch · Kong Inc. · 2026-08-12 · 6 CVEs total
| CVE-2026-18677 | 6.0 MEDIUM | Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE id |
| CVE-2026-18679 | 5.8 MEDIUM | Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate whe |
| CVE-2026-18678 | 5.5 MEDIUM | Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate whe |
| CVE-2026-18673 | 5.3 MEDIUM | Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authenticatio |
| CVE-2026-18676 | 5.1 MEDIUM | Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wild |
IV. Related Vulnerabilities
Same product: Kong Mesh
- CVE-2026-18679
Kong Mesh: kuma-dp connects to the control plane without ver - CVE-2026-18678
Kong Mesh: kumactl connects to the control plane without ver - CVE-2026-18677
Kong Mesh: a dataplane token without a workload binding can - CVE-2026-18676
Kong Mesh: default control plane config leaks the admin toke - CVE-2026-18673
Kong Mesh: the kuma-dp readiness service exposes the Envoy a
Same vendor: Kong Inc.
- CVE-2026-18679
Kong Mesh: kuma-dp connects to the control plane without ver - CVE-2026-18678
Kong Mesh: kumactl connects to the control plane without ver - CVE-2026-18677
Kong Mesh: a dataplane token without a workload binding can - CVE-2026-18676
Kong Mesh: default control plane config leaks the admin toke - CVE-2026-18673
Kong Mesh: the kuma-dp readiness service exposes the Envoy a
Same weakness: CWE-248
- CVE-2026-72813
actix-files before 0.6.10 Denial of Service via empty Range - CVE-2026-49096
Uncaught Exception in Kibana Cases Leading to Denial of Serv - CVE-2026-72660
Uncaught Exception in Kibana Leading to Denial of Service - CVE-2026-52856
Wings: Maliciously crafted packet during SFTP connection han - CVE-2026-64612
Libcupsfilters: cups-filters: libcupsfilters: cups image fil
V. Comments for CVE-2026-18675
No comments yet