CVE-2026-18679
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Summary
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.
An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Kong Inc. | Kong Mesh | 0 < 2.7.26 | affected |
| Kong Inc. | Kong Mesh | 2.8.0 < 2.9.16 | affected |
| Kong Inc. | Kong Mesh | 2.10.0 < 2.11.14 | affected |
| Kong Inc. | Kong Mesh | 2.12.0 < 2.12.11 | affected |
| Kong Inc. | Kong Mesh | 2.13.0 < 2.13.7 | affected |
Weaknesses
- CWE-295: CWE-295 Improper Certificate Validation
Workarounds
Set –ca-cert-file, or KUMA_CONTROL_PLANE_CA_CERT, on every universal mode data plane and point it at the control plane's serving CA. Alternatively terminate the control plane behind a publicly trusted certificate.
References
- https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
- https://github.com/kumahq/kuma/pull/16777
- https://developer.konghq.com/mesh/changelog/
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.