Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Kong Mesh — Vulnerabilities & Security Advisories 7

All 7 CVE vulnerabilities found in Kong Mesh, with AI-generated Chinese analysis, references, and POCs.

Vendor: Kong Inc.

CVE ID Title CVSS Severity Published
CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier CWE-345 7.0 High 2026-08-17
CVE-2026-18679 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured CWE-295 5.8 Medium 2026-08-12
CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured CWE-295 5.5 Medium 2026-08-12
CVE-2026-18677 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity CWE-290 6.0 Medium 2026-08-12
CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin CWE-346 5.1 Medium 2026-08-12
CVE-2026-18675 Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid CWE-248 5.3 Medium 2026-08-12
CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication CWE-200 5.3 Medium 2026-08-12

All 7 known CVE vulnerabilities affecting Kong Mesh with full Chinese analysis, references, and POCs where available.