Kong Mesh
Monthly
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwrite mesh resources attributed to other zones by spoofing the in-band ControlPlane.Identifier during KDS sync. Multiple release trains are affected, including all Kong Mesh versions prior to 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, and 2.14.2. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 7.0 reflects high integrity impact to global control plane state and downstream zones, with no availability impact.
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path interception in Universal mode deployments lacking explicit CA certificate configuration. An adjacent attacker who can position themselves between the data plane and control plane can intercept the dataplane authentication token, impersonate the control plane, inject a forged bootstrap configuration, and fully take over the Envoy proxy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the high subsequent-system impact (SC:H/SI:H/SA:H in CVSS 4.0) underscores the severity for affected Universal mode deployments. Vendor-confirmed patches are available across four release branches.
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HTTPS control plane profile without specifying a CA certificate via --ca-cert-file, causing API tokens to traverse the connection without server identity validation. A network-adjacent attacker capable of intercepting traffic between the operator's workstation and the control plane can steal user or administrator API tokens and subsequently issue arbitrary authenticated commands against the control plane. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified; patch versions are confirmed by the vendor advisory GHSA-v95x-xhq5-4929.
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another workload's mTLS identity by exploiting an incomplete workload-binding enforcement in the XDS authenticator. The kuma-cp authenticator validates the kuma.io/workload label only when a dataplane token is explicitly bound to a workload; because workload binding is optional, a tags-only-bound token can register any kuma.io/workload label value and receive the corresponding SPIFFE ID, bypassing MeshIdentity-enforced access controls. No public exploit has been identified at time of analysis; vendor-confirmed patches are available via upstream Kuma PRs.
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visited by an operator while the control plane is browser-reachable, due to two compounding default misconfigurations. The default CORS wildcard (`CorsAllowedDomains: [".*"]`) reflects any attacker-controlled `Origin` header, and the default `LocalhostIsAdmin: true` promotes loopback-sourced browser requests to `mesh-system:admin` without credential validation - a cross-origin `fetch()` from an attacker page is sufficient to receive full administrative credentials. This affects kuma-cp versions prior to 2.7.25, 2.9.15, 2.11.13, and 2.12.10; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the entire control plane process by submitting a JWT token whose kid header is a JSON number instead of a string. Because the Go runtime panics on the unchecked type assertion before any signature, claims, or authorization logic executes, the crash takes down kuma-cp's HTTP API, health and readiness endpoints, and xDS simultaneously. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from the PR diff; sustained availability loss requires repeated requests since the process will restart.
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster network to retrieve internal service mesh configuration without credentials. The readiness service on TCP port 9902, bound to all interfaces, acted as an unprotected reverse proxy forwarding nearly all Envoy admin read endpoints - including config dumps, cluster and listener lists, stats, and the mesh trust bundle - to any adjacent network caller. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is bounded by the adjacent network prerequisite, but the risk is elevated in multi-tenant clusters where untrusted pods share the pod network.
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwrite mesh resources attributed to other zones by spoofing the in-band ControlPlane.Identifier during KDS sync. Multiple release trains are affected, including all Kong Mesh versions prior to 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, and 2.14.2. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 7.0 reflects high integrity impact to global control plane state and downstream zones, with no availability impact.
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path interception in Universal mode deployments lacking explicit CA certificate configuration. An adjacent attacker who can position themselves between the data plane and control plane can intercept the dataplane authentication token, impersonate the control plane, inject a forged bootstrap configuration, and fully take over the Envoy proxy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the high subsequent-system impact (SC:H/SI:H/SA:H in CVSS 4.0) underscores the severity for affected Universal mode deployments. Vendor-confirmed patches are available across four release branches.
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HTTPS control plane profile without specifying a CA certificate via --ca-cert-file, causing API tokens to traverse the connection without server identity validation. A network-adjacent attacker capable of intercepting traffic between the operator's workstation and the control plane can steal user or administrator API tokens and subsequently issue arbitrary authenticated commands against the control plane. No active exploitation confirmed (not in CISA KEV) and no public exploit code has been identified; patch versions are confirmed by the vendor advisory GHSA-v95x-xhq5-4929.
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another workload's mTLS identity by exploiting an incomplete workload-binding enforcement in the XDS authenticator. The kuma-cp authenticator validates the kuma.io/workload label only when a dataplane token is explicitly bound to a workload; because workload binding is optional, a tags-only-bound token can register any kuma.io/workload label value and receive the corresponding SPIFFE ID, bypassing MeshIdentity-enforced access controls. No public exploit has been identified at time of analysis; vendor-confirmed patches are available via upstream Kuma PRs.
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visited by an operator while the control plane is browser-reachable, due to two compounding default misconfigurations. The default CORS wildcard (`CorsAllowedDomains: [".*"]`) reflects any attacker-controlled `Origin` header, and the default `LocalhostIsAdmin: true` promotes loopback-sourced browser requests to `mesh-system:admin` without credential validation - a cross-origin `fetch()` from an attacker page is sufficient to receive full administrative credentials. This affects kuma-cp versions prior to 2.7.25, 2.9.15, 2.11.13, and 2.12.10; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the entire control plane process by submitting a JWT token whose kid header is a JSON number instead of a string. Because the Go runtime panics on the unchecked type assertion before any signature, claims, or authorization logic executes, the crash takes down kuma-cp's HTTP API, health and readiness endpoints, and xDS simultaneously. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from the PR diff; sustained availability loss requires repeated requests since the process will restart.
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster network to retrieve internal service mesh configuration without credentials. The readiness service on TCP port 9902, bound to all interfaces, acted as an unprotected reverse proxy forwarding nearly all Envoy admin read endpoints - including config dumps, cluster and listener lists, stats, and the mesh trust bundle - to any adjacent network caller. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is bounded by the adjacent network prerequisite, but the risk is elevated in multi-tenant clusters where untrusted pods share the pod network.