Approved changes feed: RSS · Atom
cpe:2.3:a:kong_inc.:kong_mesh:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Kong Inc. (c5c8a0c2-4adf-5164-aed1-b4ecb6a719fa) |
|---|---|
| Product | Kong Mesh (2d4786cd-ab2c-57b7-b497-c6a0b4c1594f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-18679 |
vulnerable | 2026-09-16 04:34:01.985224 |
Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.
An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
Published: 2026-08-12T18:52:31.146Z
Updated: 2026-08-13T14:45:35.957Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-18673 |
vulnerable | 2026-09-16 04:34:01.925146 |
Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication.
An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.
Published: 2026-08-12T18:20:33.205Z
Updated: 2026-08-13T14:54:00.482Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.