Vulnerability-Lookup

CVE-2026-18675 (GCVE-0-2026-18675)

Vulnerability from cvelistv5 – Published: 2026-08-12 18:36 – Updated: 2026-08-12 18:36

Title

Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid

Summary

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-248 - Uncaught Exception
CWE-704 - Incorrect Type Conversion or Cast

Assigner

Kong

References

9 references

URL	Tags
https://github.com/kumahq/kuma/security/advisorie…	vendor-advisory
https://github.com/kumahq/kuma/pull/17465	patch
https://github.com/kumahq/kuma/pull/17468	patch
https://github.com/kumahq/kuma/pull/17467	patch
https://github.com/kumahq/kuma/pull/17471	patch
https://github.com/kumahq/kuma/pull/17469	patch
https://github.com/kumahq/kuma/pull/17470	patch
https://github.com/kumahq/kuma/pull/17472	patch
https://developer.konghq.com/mesh/changelog/	release-notes

Impacted products

1 product

Vendor	Product	Version
Kong Inc.	Kong Mesh	Affected: 0 , < 2.7.29 (semver) Affected: 2.8.0 , < 2.9.19 (semver) Affected: 2.10.0 , < 2.11.18 (semver) Affected: 2.12.0 , < 2.12.14 (semver) Affected: 2.13.0 , < 2.13.10 (semver) Affected: 2.14.0 , < 2.14.2 (semver)

Credits

https://hackerone.com/0ricky

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "kuma-cp"
          ],
          "platforms": [
            "Linux"
          ],
          "product": "Kong Mesh",
          "vendor": "Kong Inc.",
          "versions": [
            {
              "lessThan": "2.7.29",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.9.19",
              "status": "affected",
              "version": "2.8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.11.18",
              "status": "affected",
              "version": "2.10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.12.14",
              "status": "affected",
              "version": "2.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.13.10",
              "status": "affected",
              "version": "2.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.14.2",
              "status": "affected",
              "version": "2.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eYou are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\u003c/p\u003e\u003cp\u003eYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.\u003c/p\u003e"
            }
          ],
          "value": "You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.\n\n\n\nYou are not affected if the dataplane server is reachable only by trusted data planes on an isolated network."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "https://hackerone.com/0ricky"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe dataplane token validator in \u003ccode\u003ekuma-cp\u003c/code\u003e performs an unchecked Go type assertion on the JWT \u003ccode\u003ekid\u003c/code\u003e header. A token whose \u003ccode\u003ekid\u003c/code\u003e is a JSON number decodes as a \u003ccode\u003efloat64\u003c/code\u003e and triggers a runtime panic before any signature, claims, or authorization check runs.\u003c/p\u003e\u003cp\u003eThe panic terminates the entire \u003ccode\u003ekuma-cp\u003c/code\u003e process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\u003c/p\u003e\u003cp\u003eA single request is a transient interruption; sustaining an outage requires repeated requests.\u003c/p\u003e"
            }
          ],
          "value": "The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of Service"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248 Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-704",
              "description": "CWE-704 Incorrect Type Conversion or Cast",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T18:36:17.377Z",
        "orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
        "shortName": "Kong"
      },
      "references": [
        {
          "name": "Upstream advisory GHSA-5mxq-7xq4-3vx8",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8"
        },
        {
          "name": "kumahq/kuma#17465 (master)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17465"
        },
        {
          "name": "kumahq/kuma#17468 (release-2.14 backport)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17468"
        },
        {
          "name": "kumahq/kuma#17467 (release-2.13 backport)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17467"
        },
        {
          "name": "kumahq/kuma#17471 (release-2.12 backport)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17471"
        },
        {
          "name": "kumahq/kuma#17469 (release-2.11 backport)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17469"
        },
        {
          "name": "kumahq/kuma#17470 (release-2.9 backport)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17470"
        },
        {
          "name": "kumahq/kuma#17472 (release-2.7 backport)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kumahq/kuma/pull/17472"
        },
        {
          "name": "Kong Product Security Advisories",
          "tags": [
            "release-notes"
          ],
          "url": "https://developer.konghq.com/mesh/changelog/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string \u003ccode\u003ekid\u003c/code\u003e header and the dataplane server recovers from handler panics.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string kid header and the dataplane server recovers from handler panics."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-01T16:58:00.000Z",
          "value": "Kong Mesh patched releases published"
        }
      ],
      "title": "Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRestrict network access to the dataplane (xDS) gRPC port to trusted data planes.\u003c/p\u003e"
            }
          ],
          "value": "Restrict network access to the dataplane (xDS) gRPC port to trusted data planes."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
    "assignerShortName": "Kong",
    "cveId": "CVE-2026-18675",
    "datePublished": "2026-08-12T18:36:17.377Z",
    "dateReserved": "2026-08-03T15:20:42.168Z",
    "dateUpdated": "2026-08-12T18:36:17.377Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-18675\",\"sourceIdentifier\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\",\"published\":\"2026-08-12T19:17:30.650\",\"lastModified\":\"2026-08-12T19:17:30.650\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\\n\\n\\n\\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\\n\\n\\n\\nA single request is a transient interruption; sustaining an outage requires repeated requests.\"}],\"affected\":[{\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\",\"affectedData\":[{\"vendor\":\"Kong Inc.\",\"product\":\"Kong Mesh\",\"defaultStatus\":\"unaffected\",\"modules\":[\"kuma-cp\"],\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.7.29\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"2.8.0\",\"lessThan\":\"2.9.19\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"2.10.0\",\"lessThan\":\"2.11.18\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"2.12.0\",\"lessThan\":\"2.12.14\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"2.13.0\",\"lessThan\":\"2.13.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"2.14.0\",\"lessThan\":\"2.14.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-248\"},{\"lang\":\"en\",\"value\":\"CWE-704\"}]}],\"references\":[{\"url\":\"https://developer.konghq.com/mesh/changelog/\",\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\"},{\"url\":\"https://github.com/kumahq/kuma/pull/17465\",\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\"},{\"url\":\"https://github.com/kumahq/kuma/pull/17467\",\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\"},{\"url\":\"https://github.com/kumahq/kuma/pull/17468\",\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\"},{\"url\":\"https://github.com/kumahq/kuma/pull/17469\",\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\"},{\"url\":\"https://github.com/kumahq/kuma/pull/17470\",\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\"},{\"url\":\"https://github.com/kumahq/kuma/pull/17471\",\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\"},{\"url\":\"https://github.com/kumahq/kuma/pull/17472\",\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\"},{\"url\":\"https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8\",\"source\":\"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb\"}]}}"
  }
}

FKIE_CVE-2026-18675

Vulnerability from fkie_nvd - Published: 2026-08-12 19:17 - Updated: 2026-08-12 19:17

Severity

5.3 (Medium) - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	02762ae7-200e-4b20-9b2b-a77d5b8fc4cb	https://developer.konghq.com/mesh/changelog/
	02762ae7-200e-4b20-9b2b-a77d5b8fc4cb	https://github.com/kumahq/kuma/pull/17465
	02762ae7-200e-4b20-9b2b-a77d5b8fc4cb	https://github.com/kumahq/kuma/pull/17467
	02762ae7-200e-4b20-9b2b-a77d5b8fc4cb	https://github.com/kumahq/kuma/pull/17468
	02762ae7-200e-4b20-9b2b-a77d5b8fc4cb	https://github.com/kumahq/kuma/pull/17469
	02762ae7-200e-4b20-9b2b-a77d5b8fc4cb	https://github.com/kumahq/kuma/pull/17470
	02762ae7-200e-4b20-9b2b-a77d5b8fc4cb	https://github.com/kumahq/kuma/pull/17471
	02762ae7-200e-4b20-9b2b-a77d5b8fc4cb	https://github.com/kumahq/kuma/pull/17472
	02762ae7-200e-4b20-9b2b-a77d5b8fc4cb	https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "kuma-cp"
          ],
          "platforms": [
            "Linux"
          ],
          "product": "Kong Mesh",
          "vendor": "Kong Inc.",
          "versions": [
            {
              "lessThan": "2.7.29",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.9.19",
              "status": "affected",
              "version": "2.8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.11.18",
              "status": "affected",
              "version": "2.10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.12.14",
              "status": "affected",
              "version": "2.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.13.10",
              "status": "affected",
              "version": "2.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.14.2",
              "status": "affected",
              "version": "2.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests."
    }
  ],
  "id": "CVE-2026-18675",
  "lastModified": "2026-08-12T19:17:30.650",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-12T19:17:30.650",
  "references": [
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "url": "https://developer.konghq.com/mesh/changelog/"
    },
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "url": "https://github.com/kumahq/kuma/pull/17465"
    },
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "url": "https://github.com/kumahq/kuma/pull/17467"
    },
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "url": "https://github.com/kumahq/kuma/pull/17468"
    },
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "url": "https://github.com/kumahq/kuma/pull/17469"
    },
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "url": "https://github.com/kumahq/kuma/pull/17470"
    },
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "url": "https://github.com/kumahq/kuma/pull/17471"
    },
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "url": "https://github.com/kumahq/kuma/pull/17472"
    },
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8"
    }
  ],
  "sourceIdentifier": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        },
        {
          "lang": "en",
          "value": "CWE-704"
        }
      ],
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "type": "Secondary"
    }
  ]
}

GHSA-7GH2-244H-962W

Vulnerability from github – Published: 2026-08-12 21:31 – Updated: 2026-08-12 21:31

Details

The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token

A single request is a transient interruption; sustaining an outage requires repeated requests.

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-18675"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-12T19:17:30Z",
    "severity": "MODERATE"
  },
  "details": "The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.\n\n\n\nThe panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token\n\n\n\nA single request is a transient interruption; sustaining an outage requires repeated requests.",
  "id": "GHSA-7gh2-244h-962w",
  "modified": "2026-08-12T21:31:37Z",
  "published": "2026-08-12T21:31:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18675"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/17465"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/17467"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/17468"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/17469"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/17470"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/17471"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/17472"
    },
    {
      "type": "WEB",
      "url": "https://developer.konghq.com/mesh/changelog"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-18675 (GCVE-0-2026-18675)

FKIE_CVE-2026-18675

GHSA-7GH2-244H-962W

Tags

Sightings

Nomenclature