Kong Inc. — Vulnerabilities & Security Advisories 8

Browse all 8 CVE security advisories affecting Kong Inc.. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Found 7 results / 8 Clear Filters

Top products by Kong Inc.: Kong Mesh Insomnia

CVEs 8

CVE ID	Title	CVSS	Severity	Published
CVE-2026-18674	Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier — Kong Mesh CWE-345	7.0	High	2026-08-17
CVE-2026-18679	Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured — Kong Mesh CWE-295	5.8	Medium	2026-08-12
CVE-2026-18678	Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured — Kong Mesh CWE-295	5.5	Medium	2026-08-12
CVE-2026-18677	Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity — Kong Mesh CWE-290	6.0	Medium	2026-08-12
CVE-2026-18676	Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin — Kong Mesh CWE-346	5.1	Medium	2026-08-12
CVE-2026-18675	Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid — Kong Mesh CWE-248	5.3	Medium	2026-08-12
CVE-2026-18673	Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication — Kong Mesh CWE-200	5.3	Medium	2026-08-12

This page lists every published CVE security advisory associated with Kong Inc.. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.