EUVD-2026-57424
GHSA-6p7w-xxw9-j47f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H for the required MeshIdentity prerequisite; PR:L for needing a valid token; S:C because the spoofed SPIFFE identity enables access to downstream services beyond the control plane.
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
Lifecycle Timeline
2DescriptionCVE.org
In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.
AnalysisAI
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another workload's mTLS identity by exploiting an incomplete workload-binding enforcement in the XDS authenticator. The kuma-cp authenticator validates the kuma.io/workload label only when a dataplane token is explicitly bound to a workload; because workload binding is optional, a tags-only-bound token can register any kuma.io/workload label value and receive the corresponding SPIFFE ID, bypassing MeshIdentity-enforced access controls. No public exploit has been identified at time of analysis; vendor-confirmed patches are available via upstream Kuma PRs.
Technical ContextAI
Kong Mesh is an enterprise service mesh built on the open-source Kuma project (kumahq/kuma), using SPIFFE/X.509 SVIDs for workload-to-workload mTLS identity in universal (non-Kubernetes) deployments. In universal mode, dataplanes authenticate to the control plane (kuma-cp) via the XDS API using JWT dataplane tokens that can be scoped to either tags (e.g., kuma.io/service) or a specific workload name. MeshIdentity is a Kuma resource that governs how SPIFFE IDs are generated; the default universal template /workload/{{ .Workload }} derives identity directly from the kuma.io/workload dataplane label. The root cause is CWE-290 (Authentication Bypass by Spoofing): the XDS authenticator's workload-label validation branch was only reachable when the presented token carried a workload binding, so a tags-only token with a declared workload label was never subjected to that check. The fix (PR 17474) threads the ReadOnlyResourceManager and environment type into the authenticator, enabling it to look up the applicable MeshIdentity at authentication time and enforce workload-bound-token requirements when the SPIFFE path template references the workload label.
RemediationAI
Upgrade Kong Mesh to the patched release incorporating upstream Kuma PRs 17474, 17502, and 17503; the exact patched release version must be confirmed via the Kong Mesh changelog at https://developer.konghq.com/mesh/changelog/, as the specific version number was not independently confirmed from the provided data. As a compensating control pending upgrade, re-issue all dataplane tokens in universal mode as workload-bound tokens rather than tags-only-bound tokens; this causes the existing (pre-patch) authenticator to enforce the workload label check, closing the bypass path - note this requires coordinated token rotation across all dataplanes and may cause brief service disruption. Additionally, deploy or tighten MeshTrafficPermission policies to require multiple identity attributes beyond the SPIFFE ID alone where possible, reducing the blast radius if impersonation occurs. Review all MeshIdentity resources: if the workload-label-derived SPIFFE path is not operationally required, switching to a Kubernetes-style namespace/service-account template eliminates the vulnerable code path entirely on the affected version.
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwr
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HT
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the en
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visi
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today