EUVD-2026-57421
GHSA-7gh2-244h-962w
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector (AV:A) per CVSS 4.0 source; PR:N confirmed; A:H because the entire kuma-cp process crashes, not merely degraded.
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
Lifecycle Timeline
2DescriptionCVE.org
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.
The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token
A single request is a transient interruption; sustaining an outage requires repeated requests.
AnalysisAI
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the entire control plane process by submitting a JWT token whose kid header is a JSON number instead of a string. Because the Go runtime panics on the unchecked type assertion before any signature, claims, or authorization logic executes, the crash takes down kuma-cp's HTTP API, health and readiness endpoints, and xDS simultaneously. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from the PR diff; sustained availability loss requires repeated requests since the process will restart.
Technical ContextAI
The affected component is the dataplane token validator in kuma-cp (the control plane of Kuma, the open-source service mesh underlying Kong Mesh, CPE cpe:2.3:a:kong_inc.:kong_mesh:*:*:*:*:*:*:*:*). JWT headers are decoded by Go's JSON unmarshaler into a map[string]interface{}; numeric values in that map arrive as float64, not string. The validator called kid.(string) - a bare, unchecked Go type assertion - without first verifying the runtime type. This is CWE-248 (Unchecked Exception): the assertion panics at runtime when the type does not match, and because the panic propagates up the gRPC call stack without a recovery interceptor, it terminates the entire kuma-cp process. The fix, visible in the PR diff, replaces the bare assertion with a two-value checked form (keyID, ok := kid.(string)) and adds gRPC unary and streaming recovery interceptors in pkg/dp-server/server/recovery.go as a defense-in-depth measure.
RemediationAI
Upstream fixes are available across multiple backport PRs: https://github.com/kumahq/kuma/pull/17465, /17466, /17467, /17468, /17469, /17470, /17471, and /17472; the exact patched release version is not independently confirmed from the provided data, so operators should consult https://developer.konghq.com/mesh/changelog/ to identify the first tagged release incorporating these changes and upgrade to it. As a compensating control prior to patching, restrict network access to the kuma-cp dataplane gRPC port (typically 5678) to trusted dataplanes only via network policy or firewall rules - this directly removes the unauthenticated adjacent-network attack surface at the cost of blocking legitimate dataplane registrations from untrusted segments. The advisory is at https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8.
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwr
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another w
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HT
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visi
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today