CVE-2026-18678

The CVE affects Kong Mesh/Kuma’s kumactl when adding an HTTPS control-plane profile without a CA certificate. The root cause is that kumactl disables TLS verification and sends API tokens over an unverified connection. This allows an attacker on the network path between the operator and the contr...

EUVD-2026-57425

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18678

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

EUVD-2026-57423

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18675

The vulnerability CVE-2026-18675 affects Kuma Kuma CP’s dataplane token validator, which uses an unchecked Go type assertion on the JWT kid header. If a token’s kid is a JSON number, it decodes as a float64 and triggers a runtime panic before signatures, claims, or authorization checks run. This ...

CVE-2026-18675 Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process,...

PT-2026-71207

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

PT-2026-71218

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...

PT-2026-71209

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

EUVD-2026-55393

In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF VSI types The pf-txtimetxqs bitmap tracks which Tx queues have ETF Earliest TxTime First offload enabled. This bitmap is indexed by queue number and is set by iceoffloadtxtime, which...

PT-2026-69694

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the QRTR transport of the Linux kernel where port and node states are stored in module-global variables that are not partitioned per network namespace. Specifically,...

CVE-2026-44945

A privilege escalation vulnerability exists in Rancher's impersonation middleware pkg/auth/requests/impersonate.go. An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it...

CVE-2026-44945 Cross-Cluster Impersonation Confused-Deputy Privilege Escalation

A privilege escalation vulnerability exists in Rancher's impersonation middleware pkg/auth/requests/impersonate.go. An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it...

CVE-2026-44945

CVE-2026-44945 is a privilege escalation in Rancher’s impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated user with the default global role can obtain full admin access to the Rancher control plane and downstream clusters. Affected: Rancher 2.11.0–2.11.15, 2.12.0–2.12.11...

CVE-2026-44945

A privilege escalation vulnerability exists in Rancher's impersonation middleware pkg/auth/requests/impersonate.go. An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it...

CVE-2026-44945 Cross-Cluster Impersonation Confused-Deputy Privilege Escalation

A privilege escalation vulnerability exists in Rancher's impersonation middleware pkg/auth/requests/impersonate.go. An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it...

PT-2026-68090

Name of the Vulnerable Software and Affected Versions Rancher versions 2.11.0 through 2.11.15 Rancher versions 2.12.0 through 2.12.11 Rancher versions 2.13.0 through 2.13.7 Rancher versions 2.14.0 through 2.14.1 Description A privilege escalation issue exists in the impersonation middleware locat...

SUSE CVE-2026-45021

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is...