CVE-2026-18675

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18675", "assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "state": "PUBLISHED", "assignerShortName": "Kong", "dateReserved": "2026-08-03T15:20:42.168Z", "datePublished": "2026-08-12T18:36:17.377Z", "dateUpdated": "2026-08-13T15:28:44.341Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "shortName": "Kong", "dateUpdated": "2026-08-12T18:36:17.377Z"}, "title": "Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-248", "description": "CWE-248 Uncaught Exception", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-704", "description": "CWE-704 Incorrect Type Conversion or Cast", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of Service"}]}], "affected": [{"vendor": "Kong Inc.", "product": "Kong Mesh", "platforms": ["Linux"], "modules": ["kuma-cp"], "versions": [{"status": "affected", "version": "0", "lessThan": "2.7.29", "versionType": "semver"}, {"status": "affected", "version": "2.8.0", "lessThan": "2.9.19", "versionType": "semver"}, {"status": "affected", "version": "2.10.0", "lessThan": "2.11.18", "versionType": "semver"}, {"status": "affected", "version": "2.12.0", "lessThan": "2.12.14", "versionType": "semver"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.10", "versionType": "semver"}, {"status": "affected", "version": "2.14.0", "lessThan": "2.14.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The dataplane token validator in <code>kuma-cp</code> performs an unchecked Go type assertion on the JWT <code>kid</code> header. A token whose <code>kid</code> is a JSON number decodes as a <code>float64</code> and triggers a runtime panic before any signature, claims, or authorization check runs.</p><p>The panic terminates the entire <code>kuma-cp</code> process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token</p><p>A single request is a transient interruption; sustaining an outage requires repeated requests.</p>"}]}], "references": [{"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8", "name": "Upstream advisory GHSA-5mxq-7xq4-3vx8", "tags": ["vendor-advisory"]}, {"url": "https://github.com/kumahq/kuma/pull/17465", "name": "kumahq/kuma#17465 (master)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17468", "name": "kumahq/kuma#17468 (release-2.14 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17467", "name": "kumahq/kuma#17467 (release-2.13 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17471", "name": "kumahq/kuma#17471 (release-2.12 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17469", "name": "kumahq/kuma#17469 (release-2.11 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17470", "name": "kumahq/kuma#17470 (release-2.9 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17472", "name": "kumahq/kuma#17472 (release-2.7 backport)", "tags": ["patch"]}, {"url": "https://developer.konghq.com/mesh/changelog/", "name": "Kong Product Security Advisories", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "configurations": [{"lang": "en", "value": "You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\n\n\n\nYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.</p><p>You are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.</p>"}]}], "workarounds": [{"lang": "en", "value": "Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string kid header and the dataplane server recovers from handler panics.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string <code>kid</code> header and the dataplane server recovers from handler panics.</p>"}]}], "timeline": [{"time": "2026-08-01T16:58:00.000Z", "lang": "en", "value": "Kong Mesh patched releases published"}], "credits": [{"lang": "en", "value": "https://hackerone.com/0ricky", "type": "finder"}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T15:28:24.304122Z", "id": "CVE-2026-18675", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:28:44.341Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "https://hackerone.com/0ricky"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of Service"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Kong Inc.", "modules": ["kuma-cp"], "product": "Kong Mesh", "versions": [{"status": "affected", "version": "0", "lessThan": "2.7.29", "versionType": "semver"}, {"status": "affected", "version": "2.8.0", "lessThan": "2.9.19", "versionType": "semver"}, {"status": "affected", "version": "2.10.0", "lessThan": "2.11.18", "versionType": "semver"}, {"status": "affected", "version": "2.12.0", "lessThan": "2.12.14", "versionType": "semver"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.10", "versionType": "semver"}, {"status": "affected", "version": "2.14.0", "lessThan": "2.14.2", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-08-01T16:58:00.000Z", "value": "Kong Mesh patched releases published"}], "solutions": [{"lang": "en", "value": "Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string kid header and the dataplane server recovers from handler panics.", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string <code>kid</code> header and the dataplane server recovers from handler panics.</p>", "base64": false}]}], "references": [{"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8", "name": "Upstream advisory GHSA-5mxq-7xq4-3vx8", "tags": ["vendor-advisory"]}, {"url": "https://github.com/kumahq/kuma/pull/17465", "name": "kumahq/kuma#17465 (master)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17468", "name": "kumahq/kuma#17468 (release-2.14 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17467", "name": "kumahq/kuma#17467 (release-2.13 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17471", "name": "kumahq/kuma#17471 (release-2.12 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17469", "name": "kumahq/kuma#17469 (release-2.11 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17470", "name": "kumahq/kuma#17470 (release-2.9 backport)", "tags": ["patch"]}, {"url": "https://github.com/kumahq/kuma/pull/17472", "name": "kumahq/kuma#17472 (release-2.7 backport)", "tags": ["patch"]}, {"url": "https://developer.konghq.com/mesh/changelog/", "name": "Kong Product Security Advisories", "tags": ["release-notes"]}], "workarounds": [{"lang": "en", "value": "Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.", "supportingMedia": [{"type": "text/html", "value": "<p>Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests.", "supportingMedia": [{"type": "text/html", "value": "<p>The dataplane token validator in <code>kuma-cp</code> performs an unchecked Go type assertion on the JWT <code>kid</code> header. A token whose <code>kid</code> is a JSON number decodes as a <code>float64</code> and triggers a runtime panic before any signature, claims, or authorization check runs.</p><p>The panic terminates the entire <code>kuma-cp</code> process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token</p><p>A single request is a transient interruption; sustaining an outage requires repeated requests.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248 Uncaught Exception"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-704", "description": "CWE-704 Incorrect Type Conversion or Cast"}]}], "configurations": [{"lang": "en", "value": "You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\n\n\n\nYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.", "supportingMedia": [{"type": "text/html", "value": "<p>You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.</p><p>You are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.</p>", "base64": false}]}], "providerMetadata": {"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "shortName": "Kong", "dateUpdated": "2026-08-12T18:36:17.377Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18675", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T15:28:24.304122Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-13T15:28:35.818Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-18675", "state": "PUBLISHED", "dateUpdated": "2026-08-12T18:36:17.377Z", "dateReserved": "2026-08-03T15:20:42.168Z", "assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "datePublished": "2026-08-12T18:36:17.377Z", "assignerShortName": "Kong"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["kuma-cp"], "platforms": ["Linux"], "product": "Kong Mesh", "vendor": "Kong Inc.", "versions": [{"lessThan": "2.7.29", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2.9.19", "status": "affected", "version": "2.8.0", "versionType": "semver"}, {"lessThan": "2.11.18", "status": "affected", "version": "2.10.0", "versionType": "semver"}, {"lessThan": "2.12.14", "status": "affected", "version": "2.12.0", "versionType": "semver"}, {"lessThan": "2.13.10", "status": "affected", "version": "2.13.0", "versionType": "semver"}, {"lessThan": "2.14.2", "status": "affected", "version": "2.14.0", "versionType": "semver"}]}], "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests."}, {"lang": "es", "value": "El validador de tokens del plano de datos en kuma-cp realiza una aserci\u00f3n de tipo Go sin verificar en el encabezado \u2019kid\u2019 de JWT. Un token cuyo \u2019kid\u2019 es un n\u00famero JSON se decodifica como un float64 y desencadena un p\u00e1nico en tiempo de ejecuci\u00f3n antes de que se ejecute cualquier verificaci\u00f3n de firma, reclamaciones o autorizaci\u00f3n.\n\nEl p\u00e1nico termina todo el proceso de kuma-cp, la API HTTP, los puntos finales de salud y disponibilidad, y xDS. El acceso no autenticado al servidor gRPC del plano de datos puede desencadenar el fallo con un token malformado.\n\nUna \u00fanica solicitud es una interrupci\u00f3n transitoria; mantener una interrupci\u00f3n del servicio requiere solicitudes repetidas."}], "id": "CVE-2026-18675", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18675", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T15:28:24.304122Z", "version": "2.0.3"}}]}, "published": "2026-08-12T19:17:30.650", "references": [{"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://developer.konghq.com/mesh/changelog/"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17465"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17467"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17468"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17469"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17470"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17471"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/pull/17472"}, {"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8"}], "sourceIdentifier": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}, {"lang": "en", "value": "CWE-704"}], "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.7.29)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[2.8.0,2.9.19)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[2.10.0,2.11.18)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0,2.12.14)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[2.13.0,2.13.10)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[2.14.0,2.14.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Kong Mesh", "source": "cna", "vendor": "Kong Inc."}, "product": "kong_mesh", "vendor": "konghq"}], "created": "2026-08-12T23:45:03.036233+00:00", "updated": "2026-08-13T09:48:10.863790+00:00", "vendors": ["konghq", "konghq$PRODUCT$kong_mesh"]}