EUVD-2026-57424
GHSA-6p7w-xxw9-j47f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H for the required MeshIdentity prerequisite; PR:L for needing a valid token; S:C because the spoofed SPIFFE identity enables access to downstream services beyond the control plane.
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
Lifecycle Timeline
2DescriptionCVE.org
In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.
AnalysisAI
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another workload's mTLS identity by exploiting an incomplete workload-binding enforcement in the XDS authenticator. The kuma-cp authenticator validates the kuma.io/workload label only when a dataplane token is explicitly bound to a workload; because workload binding is optional, a tags-only-bound token can register any kuma.io/workload label value and receive the corresponding SPIFFE ID, bypassing MeshIdentity-enforced access controls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions to hold simultaneously: (1) Kong Mesh is deployed in universal mode - Kubernetes-mode deployments use a different authentication path and are not affected; (2) at least one MeshIdentity resource is present in the target mesh whose SPIFFE ID path template contains the {{ .Workload }} variable, specifically templates like the default universal template /workload/{{ .Workload }} - MeshIdentities using only {{ .Namespace }}/{{ .ServiceAccount }} or custom non-workload templates do not trigger the vulnerable branch, as confirmed by the test cases in PR 17474; (3) the attacker possesses a valid tags-bound (not workload-bound) dataplane token for the mesh, requiring at minimum low-privilege authenticated access to the token issuance API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L) scores 6.0, which is appropriately calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kong Mesh to the patched release incorporating upstream Kuma PRs 17474, 17502, and 17503; the exact patched release version must be confirmed via the Kong Mesh changelog at https://developer.konghq.com/mesh/changelog/, as the specific version number was not independently confirmed from the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwr
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HT
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the en
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visi
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today