CVE-2026-18675 (GCVE-0-2026-18675)
Vulnerability from cvelistv5
Published
2026-08-12 18:36
Modified
2026-08-13 15:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.
The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token
A single request is a transient interruption; sustaining an outage requires repeated requests.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18675",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:28:24.304122Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:28:44.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"kuma-cp"
],
"platforms": [
"Linux"
],
"product": "Kong Mesh",
"vendor": "Kong Inc.",
"versions": [
{
"lessThan": "2.7.29",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.9.19",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
},
{
"lessThan": "2.11.18",
"status": "affected",
"version": "2.10.0",
"versionType": "semver"
},
{
"lessThan": "2.12.14",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.13.10",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
},
{
"lessThan": "2.14.2",
"status": "affected",
"version": "2.14.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eYou are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\u003c/p\u003e\u003cp\u003eYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.\u003c/p\u003e"
}
],
"value": "You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\n\n\n\nYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "https://hackerone.com/0ricky"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe dataplane token validator in \u003ccode\u003ekuma-cp\u003c/code\u003e performs an unchecked Go type assertion on the JWT \u003ccode\u003ekid\u003c/code\u003e header. A token whose \u003ccode\u003ekid\u003c/code\u003e is a JSON number decodes as a \u003ccode\u003efloat64\u003c/code\u003e and triggers a runtime panic before any signature, claims, or authorization check runs.\u003c/p\u003e\u003cp\u003eThe panic terminates the entire \u003ccode\u003ekuma-cp\u003c/code\u003e process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\u003c/p\u003e\u003cp\u003eA single request is a transient interruption; sustaining an outage requires repeated requests.\u003c/p\u003e"
}
],
"value": "The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Denial of Service"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-704",
"description": "CWE-704 Incorrect Type Conversion or Cast",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:36:17.377Z",
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"shortName": "Kong"
},
"references": [
{
"name": "Upstream advisory GHSA-5mxq-7xq4-3vx8",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8"
},
{
"name": "kumahq/kuma#17465 (master)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17465"
},
{
"name": "kumahq/kuma#17468 (release-2.14 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17468"
},
{
"name": "kumahq/kuma#17467 (release-2.13 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17467"
},
{
"name": "kumahq/kuma#17471 (release-2.12 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17471"
},
{
"name": "kumahq/kuma#17469 (release-2.11 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17469"
},
{
"name": "kumahq/kuma#17470 (release-2.9 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17470"
},
{
"name": "kumahq/kuma#17472 (release-2.7 backport)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/17472"
},
{
"name": "Kong Product Security Advisories",
"tags": [
"release-notes"
],
"url": "https://developer.konghq.com/mesh/changelog/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string \u003ccode\u003ekid\u003c/code\u003e header and the dataplane server recovers from handler panics.\u003c/p\u003e"
}
],
"value": "Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string kid header and the dataplane server recovers from handler panics."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-01T16:58:00.000Z",
"value": "Kong Mesh patched releases published"
}
],
"title": "Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict network access to the dataplane (xDS) gRPC port to trusted data planes.\u003c/p\u003e"
}
],
"value": "Restrict network access to the dataplane (xDS) gRPC port to trusted data planes."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"assignerShortName": "Kong",
"cveId": "CVE-2026-18675",
"datePublished": "2026-08-12T18:36:17.377Z",
"dateReserved": "2026-08-03T15:20:42.168Z",
"dateUpdated": "2026-08-13T15:28:44.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"https://hackerone.com/0ricky\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Denial of Service\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Kong Inc.\", \"modules\": [\"kuma-cp\"], \"product\": \"Kong Mesh\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.7.29\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.8.0\", \"lessThan\": \"2.9.19\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.10.0\", \"lessThan\": \"2.11.18\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.12.0\", \"lessThan\": \"2.12.14\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.13.0\", \"lessThan\": \"2.13.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"2.14.0\", \"lessThan\": \"2.14.2\", \"versionType\": \"semver\"}], \"platforms\": [\"Linux\"], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-08-01T16:58:00.000Z\", \"value\": \"Kong Mesh patched releases published\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string kid header and the dataplane server recovers from handler panics.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUpgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string \u003ccode\u003ekid\u003c/code\u003e header and the dataplane server recovers from handler panics.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8\", \"name\": \"Upstream advisory GHSA-5mxq-7xq4-3vx8\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/kumahq/kuma/pull/17465\", \"name\": \"kumahq/kuma#17465 (master)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/kumahq/kuma/pull/17468\", \"name\": \"kumahq/kuma#17468 (release-2.14 backport)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/kumahq/kuma/pull/17467\", \"name\": \"kumahq/kuma#17467 (release-2.13 backport)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/kumahq/kuma/pull/17471\", \"name\": \"kumahq/kuma#17471 (release-2.12 backport)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/kumahq/kuma/pull/17469\", \"name\": \"kumahq/kuma#17469 (release-2.11 backport)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/kumahq/kuma/pull/17470\", \"name\": \"kumahq/kuma#17470 (release-2.9 backport)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/kumahq/kuma/pull/17472\", \"name\": \"kumahq/kuma#17472 (release-2.7 backport)\", \"tags\": [\"patch\"]}, {\"url\": \"https://developer.konghq.com/mesh/changelog/\", \"name\": \"Kong Product Security Advisories\", \"tags\": [\"release-notes\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eRestrict network access to the dataplane (xDS) gRPC port to trusted data planes.\u003c/p\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\\n\\n\\n\\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\\n\\n\\n\\nA single request is a transient interruption; sustaining an outage requires repeated requests.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe dataplane token validator in \u003ccode\u003ekuma-cp\u003c/code\u003e performs an unchecked Go type assertion on the JWT \u003ccode\u003ekid\u003c/code\u003e header. A token whose \u003ccode\u003ekid\u003c/code\u003e is a JSON number decodes as a \u003ccode\u003efloat64\u003c/code\u003e and triggers a runtime panic before any signature, claims, or authorization check runs.\u003c/p\u003e\u003cp\u003eThe panic terminates the entire \u003ccode\u003ekuma-cp\u003c/code\u003e process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\u003c/p\u003e\u003cp\u003eA single request is a transient interruption; sustaining an outage requires repeated requests.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-248\", \"description\": \"CWE-248 Uncaught Exception\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-704\", \"description\": \"CWE-704 Incorrect Type Conversion or Cast\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\\n\\n\\n\\nYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eYou are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\u003c/p\u003e\u003cp\u003eYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.\u003c/p\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\", \"shortName\": \"Kong\", \"dateUpdated\": \"2026-08-12T18:36:17.377Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-18675\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-13T15:28:24.304122Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-08-13T15:28:35.818Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-18675\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-12T18:36:17.377Z\", \"dateReserved\": \"2026-08-03T15:20:42.168Z\", \"assignerOrgId\": \"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\", \"datePublished\": \"2026-08-12T18:36:17.377Z\", \"assignerShortName\": \"Kong\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…