Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2026-18679

Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Kong

Description

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kong Inc. Kong Mesh

Default version status: unaffected

  • 0 to < 2.7.26affected
  • 2.8.0 to < 2.9.16affected
  • 2.10.0 to < 2.11.14affected
  • 2.12.0 to < 2.12.11affected
  • 2.13.0 to < 2.13.7affected

References