Is there a patch available for EUVD-2026-57425?

Yes, a patch is available for EUVD-2026-57425. Update the affected software to the latest version immediately.

Kong Mesh EUVD-2026-57425

Q: What is the CVSS score of EUVD-2026-57425?

EUVD-2026-57425 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-18678 MEDIUM

Improper Certificate Validation (CWE-295)

2026-08-12 Kong

GHSA-26pg-x7g5-9g43

Information Disclosure Kong Mesh Kong Inc

5.5

CVSS 4.0 · Vendor: Kong

Severity by source

Vendor (Kong) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.9 HIGH

Adjacent-only attacker access and MitM requirement justify AV:A/AC:H; no attacker privileges needed; operator must run a command (UI:R); token theft affects separate control plane system (S:C).

3.1 AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (Kong).

CVSS VectorVendor: Kong

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 12, 2026 - 19:21 vuln.today

Analysis Generated

Aug 12, 2026 - 19:21 vuln.today

DescriptionCVE.org

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

AnalysisAI

TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HTTPS control plane profile without specifying a CA certificate via --ca-cert-file, causing API tokens to traverse the connection without server identity validation. A network-adjacent attacker capable of intercepting traffic between the operator's workstation and the control plane can steal user or administrator API tokens and subsequently issue arbitrary authenticated commands against the control plane. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified; patch versions are confirmed by the vendor advisory GHSA-v95x-xhq5-4929.

Technical ContextAI

Kuma (upstream of Kong Mesh) is a CNCF-affiliated service mesh built on Envoy, managed through the kumactl CLI. When adding a control plane profile over HTTPS, kumactl configures an HTTP client with TLS settings; the pre-fix code path set InsecureSkipVerify=true whenever CaCert was empty, rather than falling back to OS trust store validation or failing loudly. This is a textbook CWE-295 (Improper Certificate Validation) defect - the software establishes a TLS session but foregoes certificate chain and hostname verification, rendering the encryption transport-only without authentication. The CPE cpe:2.3:a:kong_inc.:kong_mesh:*:*:*:*:*:*:*:* covers the affected Go package go/github.com/kumahq/kuma/v2. The fix (PR #16777, commit 2ecadac1) changes the default behavior to verify against the OS trust store when no CA cert is provided, and introduces an explicit --skip-verify flag (defaulting to false) for scenarios where insecure mode is genuinely required during development.

RemediationAI

The primary fix is to upgrade to a patched release: 2.7.26 (for the 2.7.x line), 2.9.16 (for 2.8.x/2.9.x), 2.11.14 (for 2.10.x/2.11.x), or 2.12.11 (for 2.12.x). These versions change the default TLS behavior to verify against the operating system trust store when no CA cert is provided, and require explicit opt-in via --skip-verify for insecure mode. As an immediate workaround before patching, always pass --ca-cert-file pointing to the control plane's serving CA when running kumactl config control-planes add against an HTTPS endpoint; this prevents the silent fallback to insecure mode. Alternatively, terminate the control plane behind a certificate issued by a publicly trusted CA, which the patched releases will validate automatically against the OS trust store. Audit all existing kumactl profiles (typically in ~/.kuma/config) to identify any HTTPS entries with empty caCertFile fields and reconfigure them. Advisory and patch references: https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929 and https://github.com/kumahq/kuma/pull/16777.