EUVD-2026-57427
GHSA-wc82-hqx6-g35q
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector and high complexity for required on-path position; scope changed and full C/I/A impact on the hijacked proxy system.
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
Lifecycle Timeline
2DescriptionCVE.org
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.
An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
AnalysisAI
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path interception in Universal mode deployments lacking explicit CA certificate configuration. An adjacent attacker who can position themselves between the data plane and control plane can intercept the dataplane authentication token, impersonate the control plane, inject a forged bootstrap configuration, and fully take over the Envoy proxy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions: (1) The target kuma-dp instance must be running in Universal mode (non-Kubernetes) and started without --ca-cert-file or the KUMA_CONTROL_PLANE_CA_CERT environment variable set - this is the deployment misconfiguration that triggers TLS verification bypass; (2) The attacker must achieve an adjacent on-path network position between kuma-dp and the Kuma control plane at the time kuma-dp bootstraps (AV:A in CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H) scores 5.8, which appropriately reflects the constrained exploitation prerequisites: adjacent network position (AV:A) and a specific deployment condition (AT:P - Universal mode without CA cert). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade kuma-dp to a patched release: 2.7.26 (for 2.7.x), 2.9.16 (for 2.8.x/2.9.x), 2.11.14 (for 2.10.x/2.11.x), or 2.12.11 (for 2.12.x). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwr
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another w
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HT
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the en
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visi
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today