What’s Vulnerable › Vulnerabilities

CVE-2026-18679: Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

• Severity: medium (CVSS 5.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-10-23
• Weakness: CWE-295

Description

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.

Affected products

• Kong Inc. Kong Mesh: before 2.7.26; from 2.8.0 before 2.9.16; from 2.10.0 before 2.11.14; from 2.12.0 before 2.12.11; from 2.13.0 before 2.13.7 — fixed in 2.11.14, 2.12.11, 2.13.7, 2.7.26, 2.9.16

How to fix

Upgrade to a fixed version: Kong Inc. Kong Mesh 2.11.14, 2.12.11, 2.13.7, 2.7.26. Check the vendor advisory for mitigations.

References

• https://developer.konghq.com/mesh/changelog/
• https://github.com/kumahq/kuma/pull/16777
• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv

Get alerted when CVE-2026-18679 or the next vulnerability affects your stack