CVE-2026-18677

In Kong Mesh (universal mode), the XDS authenticator in kuma-cp validates the dataplane’s SPIFFE ID path template against the kuma.io/workload label only when the dataplane token is bound to a workload. Because workload binding is optional, a dataplane presenting a tags-bound token can register w...

EUVD-2026-57424

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

GHSA-WVMP-6R4V-J6CV kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection Impact An on-path attacker can intercept the dataplane...

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection Impact An on-path attacker can intercept the dataplane...