CVE-2026-18677 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

EUVD-2026-57423

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18676

The CVE-2026-18676 entry concerns Kong Mesh by exposing the admin bootstrap token and signing keys via a CORS misconfiguration in the default kuma-cp configuration. The vulnerability arises because a cross-origin fetch() from a malicious page can retrieve the admin JWT and signing material when t...

CVE-2026-18675

The vulnerability CVE-2026-18675 affects Kuma Kuma CP’s dataplane token validator, which uses an unchecked Go type assertion on the JWT kid header. If a token’s kid is a JSON number, it decodes as a float64 and triggers a runtime panic before signatures, claims, or authorization checks run. This ...

CVE-2026-18675 Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process,...

CVE-2026-18675 Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process,...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

PT-2026-71208

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

CVE-2026-19174

creationtimestamp| type| source ---|---|--- 2026-08-07 04:48:36+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:47:40+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...

CVE-2026-19171

creationtimestamp| type| source ---|---|--- 2026-08-07 04:48:30+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:47:33+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...

CVE-2026-19169

creationtimestamp| type| source ---|---|--- 2026-08-07 04:47:55+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:47:29+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...

CVE-2026-19168

creationtimestamp| type| source ---|---|--- 2026-08-07 04:47:52+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:47:27+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...

CVE-2026-19165

creationtimestamp| type| source ---|---|--- 2026-08-07 04:47:15+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-07 17:12:24+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117055340138145623 2026-08-13 09:47:20+00:00| seen|...

CVE-2026-19164

creationtimestamp| type| source ---|---|--- 2026-08-07 04:47:12+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-07 14:38:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msirtxq2cn2r 2026-08-09 06:16:14+00:00| seen|...

CVE-2026-19160

creationtimestamp| type| source ---|---|--- 2026-08-07 04:46:33+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:47:08+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...

CVE-2026-19157

creationtimestamp| type| source ---|---|--- 2026-08-07 04:46:26+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-07 14:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msirtwdgl727 2026-08-13 09:47:01+00:00| seen|...

CVE-2026-19156

creationtimestamp| type| source ---|---|--- 2026-08-07 04:46:23+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:46:59+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0999...