EUVD-2026-57398
GHSA-jcrf-7pr5-jv5v
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network access required (pod network); no auth needed; strictly read-only exposure so integrity and availability are unaffected.
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
Lifecycle Timeline
2DescriptionCVE.org
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication.
An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.
AnalysisAI
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster network to retrieve internal service mesh configuration without credentials. The readiness service on TCP port 9902, bound to all interfaces, acted as an unprotected reverse proxy forwarding nearly all Envoy admin read endpoints - including config dumps, cluster and listener lists, stats, and the mesh trust bundle - to any adjacent network caller. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to TCP port 9902 on a kuma-dp data plane pod - achievable from another pod on the same Kubernetes cluster pod network (AV:A). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:A correctly reflects that exploitation requires adjacent network access - specifically, access to the Kubernetes pod network - rather than arbitrary internet reachability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade kuma-dp to the patched version incorporating the changes from GitHub PRs #17317 (https://github.com/kumahq/kuma/pull/17317) and #17418 (https://github.com/kumahq/kuma/pull/17418). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwr
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another w
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HT
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the en
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visi
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today