Kong Inc. Kong Mesh

• CVE-2026-18674 High 7.0 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier 0.6%
• CVE-2026-18679 Medium 5.8 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured 0.2%
• CVE-2026-18678 Medium 5.5 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured 0.1%
• CVE-2026-18677 Medium 6.0 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity 0.6%
• CVE-2026-18676 Medium 5.1 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin 0.3%
• CVE-2026-18675 Medium 5.3 Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid 0.6%
• CVE-2026-18673 Medium 5.3 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication 0.5%