CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

[
  {
    "vendor": "Kong Inc.",
    "product": "Kong Mesh",
    "platforms": [
      "Linux"
    ],
    "modules": [
      "kuma-cp"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.7.29",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.8.0",
        "lessThan": "2.9.19",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.10.0",
        "lessThan": "2.11.18",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.12.0",
        "lessThan": "2.12.14",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.13.0",
        "lessThan": "2.13.10",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.14.0",
        "lessThan": "2.14.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]