CVE-2026-18675 PUBLISHED

Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid

Assigner: Kong
Reserved: 03.08.2026 Published: 12.08.2026 Updated: 13.08.2026

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.

The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token

A single request is a transient interruption; sustaining an outage requires repeated requests.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor Kong Inc.
Product Kong Mesh
Versions Default: unaffected
  • affected from 0 to 2.7.29 (excl.)
  • affected from 2.8.0 to 2.9.19 (excl.)
  • affected from 2.10.0 to 2.11.18 (excl.)
  • affected from 2.12.0 to 2.12.14 (excl.)
  • affected from 2.13.0 to 2.13.10 (excl.)
  • affected from 2.14.0 to 2.14.2 (excl.)

Affected Configurations

You are affected if any control plane has its dataplane (xDS) gRPC server reachable by an untrusted party.

You are not affected if the dataplane server is reachable only by trusted data planes on an isolated network.

Workarounds

Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.

Solutions

Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string kid header and the dataplane server recovers from handler panics.

Credits

  • https://hackerone.com/0ricky finder

References

Problem Types

  • CWE-248 Uncaught Exception CWE
  • CWE-704 Incorrect Type Conversion or Cast CWE

Impacts

  • Denial of Service