Vulnerability · Published Aug 12, 2026 · Assigned by Kong

CVE-2026-18673Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

Medium 5.3

In plain English

A medium-severity information exposure in Kong Mesh from Kong Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.5%top 60.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.

Affected products (as reported)

Vendor	Product	Versions
Kong Inc.	Kong Mesh	2.14.0 – before 2.14.2

Weakness: CWE-200, CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

Upstream advisory GHSA-r9pv-x3pm-4r2w vendor-advisory
kumahq/kuma#17317 (master) patch
kumahq/kuma#17418 (release-2.14 backport) patch
Kong Product Security Advisories vendor-advisory