Log in Start free

Vulnerability · Published Aug 12, 2026 · Assigned by Kong

CVE-2026-18675Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid

Medium 5.3

In plain English

A medium-severity security flaw in Kong Mesh from Kong Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.

Affected products (as reported)

VendorProductVersions
Kong Inc. Kong Mesh 0 – before 2.7.292.8.0 – before 2.9.192.10.0 – before 2.11.182.12.0 – before 2.12.142.13.0 – before 2.13.102.14.0 – before 2.14.2

Weakness: CWE-248, CWE-704 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References