What’s Vulnerable › Products

Kong Inc. Kong Mesh vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Kong Inc. Kong Mesh version is affected

Latest Kong Inc. Kong Mesh vulnerabilities

• CVE-2026-18674 — Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier (CVSS 7.0)
• CVE-2026-18679 — Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured (CVSS 5.8)
• CVE-2026-18678 — Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured (CVSS 5.5)
• CVE-2026-18677 — Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity (CVSS 6.0)
• CVE-2026-18676 — Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin (CVSS 5.1)
• CVE-2026-18675 — Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid (CVSS 5.3)
• CVE-2026-18673 — Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication (CVSS 5.3)