CVE-2026-18677 PUBLISHED

Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

Assigner: Kong
Reserved: 03.08.2026 Published: 12.08.2026 Updated: 13.08.2026

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6

Product Status

Vendor Kong Inc.
Product Kong Mesh
Versions Default: unaffected
  • affected from 2.13.0 to 2.13.10 (excl.)
  • affected from 2.14.0 to 2.14.2 (excl.)

Affected Configurations

You are affected if all of the following hold:

  • The control plane runs in universal mode.
  • A MeshIdentity is configured whose SPIFFE ID path template derives from the workload label, including the default universal template /workload/{{ .Workload }}.
  • Dataplanes authenticate with tokens that are not bound to a workload (tags-bound tokens, the common case, since workload binding is newer and optional).

You are not affected if:

  • The control plane runs in Kubernetes mode. Its identity template is /ns/{{ .Namespace }}/sa/{{ .ServiceAccount }}, and the control plane derives those values from the pod's real identity rather than from a label the workload sets.
  • Your MeshIdentity uses a SPIFFE template that does not reference the workload label.
  • Every dataplane whose identity derives from the workload label already uses a workload-bound token.

Workarounds

Issue workload-bound dataplane tokens for every dataplane whose identity derives from the kuma.io/workload label. A workload-bound token constrains that label to the bound value, so a mismatched label is rejected at authentication.

Solutions

Upgrade to Kong Mesh 2.13.10 or 2.14.2, whichever matches your release line. In patched versions a dataplane whose identity derives from the kuma.io/workload label requires a workload-bound token; an unbound tags-only token is rejected at XDS authentication. Kubernetes mode and universal templates that do not reference the workload label keep working with unbound tokens.

Credits

  • kanywst finder

References

Problem Types

  • CWE-290 Authentication Bypass by Spoofing CWE

Impacts

  • Workload identity spoofing