{"id":"CVE-2026-18675","state":"PUBLISHED","title":"Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid","description":"The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests.","publishedAt":"2026-08-12T18:36:17.377Z","updatedAt":"2026-08-13T15:28:44.341Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","source":"Kong"},"assigner":"Kong","products":["Kong Inc. Kong Mesh"],"affected":[{"vendor":"Kong Inc.","product":"Kong Mesh","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.7.29","versionType":"semver"},{"version":"2.8.0","status":"affected","lessThan":"2.9.19","versionType":"semver"},{"version":"2.10.0","status":"affected","lessThan":"2.11.18","versionType":"semver"},{"version":"2.12.0","status":"affected","lessThan":"2.12.14","versionType":"semver"},{"version":"2.13.0","status":"affected","lessThan":"2.13.10","versionType":"semver"},{"version":"2.14.0","status":"affected","lessThan":"2.14.2","versionType":"semver"}],"platforms":["Linux"],"modules":["kuma-cp"]}],"references":["https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8","https://github.com/kumahq/kuma/pull/17465","https://github.com/kumahq/kuma/pull/17468","https://github.com/kumahq/kuma/pull/17467","https://github.com/kumahq/kuma/pull/17471","https://github.com/kumahq/kuma/pull/17469","https://github.com/kumahq/kuma/pull/17470","https://github.com/kumahq/kuma/pull/17472","https://developer.konghq.com/mesh/changelog/"],"weaknesses":["CWE-248","CWE-704"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/18xxx/CVE-2026-18675.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18675","state":"PUBLISHED","datePublished":"2026-08-12T18:36:17.377Z","dateUpdated":"2026-08-13T15:28:44.341Z","assignerShortName":"Kong","assignerOrgId":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","dateReserved":"2026-08-03T15:20:42.168Z"},"containers":{"cna":{"title":"Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid","descriptions":[{"lang":"en","value":"The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests."}],"affected":[{"vendor":"Kong Inc.","product":"Kong Mesh","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.7.29","versionType":"semver"},{"version":"2.8.0","status":"affected","lessThan":"2.9.19","versionType":"semver"},{"version":"2.10.0","status":"affected","lessThan":"2.11.18","versionType":"semver"},{"version":"2.12.0","status":"affected","lessThan":"2.12.14","versionType":"semver"},{"version":"2.13.0","status":"affected","lessThan":"2.13.10","versionType":"semver"},{"version":"2.14.0","status":"affected","lessThan":"2.14.2","versionType":"semver"}],"platforms":["Linux"],"modules":["kuma-cp"]}],"references":[{"url":"https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8","name":"Upstream advisory GHSA-5mxq-7xq4-3vx8","tags":["vendor-advisory"]},{"url":"https://github.com/kumahq/kuma/pull/17465","name":"kumahq/kuma#17465 (master)","tags":["patch"]},{"url":"https://github.com/kumahq/kuma/pull/17468","name":"kumahq/kuma#17468 (release-2.14 backport)","tags":["patch"]},{"url":"https://github.com/kumahq/kuma/pull/17467","name":"kumahq/kuma#17467 (release-2.13 backport)","tags":["patch"]},{"url":"https://github.com/kumahq/kuma/pull/17471","name":"kumahq/kuma#17471 (release-2.12 backport)","tags":["patch"]},{"url":"https://github.com/kumahq/kuma/pull/17469","name":"kumahq/kuma#17469 (release-2.11 backport)","tags":["patch"]},{"url":"https://github.com/kumahq/kuma/pull/17470","name":"kumahq/kuma#17470 (release-2.9 backport)","tags":["patch"]},{"url":"https://github.com/kumahq/kuma/pull/17472","name":"kumahq/kuma#17472 (release-2.7 backport)","tags":["patch"]},{"url":"https://developer.konghq.com/mesh/changelog/","name":"Kong Product Security Advisories","tags":["release-notes"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.3,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-248","lang":"en","description":"CWE-248 Uncaught Exception","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-704","lang":"en","description":"CWE-704 Incorrect Type Conversion or Cast","type":"CWE"}]}],"providerMetadata":{"shortName":"Kong","orgId":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","dateUpdated":"2026-08-12T18:36:17.377Z"},"impacts":[{"descriptions":[{"lang":"en","value":"Denial of Service"}]}],"configurations":[{"lang":"en","value":"You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\n\n\n\nYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.</p><p>You are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.</p>"}]}],"workarounds":[{"lang":"en","value":"Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.</p>"}]}],"solutions":[{"lang":"en","value":"Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string kid header and the dataplane server recovers from handler panics.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string <code>kid</code> header and the dataplane server recovers from handler panics.</p>"}]}],"timeline":[{"time":"2026-08-01T16:58:00.000Z","lang":"en","value":"Kong Mesh patched releases published"}],"credits":[{"lang":"en","value":"https://hackerone.com/0ricky","type":"finder"}],"source":{"discovery":"EXTERNAL"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-13T15:28:24.304122Z","id":"CVE-2026-18675","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-13T15:28:44.341Z"}}]}}}