{"id":"CVE-2026-18679","revision":"5d4539f79a1f4e758e86132eaa12d898","records":[{"revision":"5d4539f79a1f4e758e86132eaa12d898","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-18679","aliases":[],"title":"Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","state":0,"publishedAt":"2026-08-12T18:52:31.146+00:00","modifiedAt":"2026-08-13T14:45:35.957+00:00","affected":[{"ecosystem":"Vendor product","name":"Kong Mesh","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Kong Inc.\",\n                    \"product\": \"Kong Mesh\",\n                    \"platforms\": [\n                        \"Linux\"\n                    ],\n                    \"modules\": [\n                        \"kuma-dp\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.7.26\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.8.0\",\n                            \"lessThan\": \"2.9.16\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.10.0\",\n                            \"lessThan\": \"2.11.14\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.12.0\",\n                            \"lessThan\": \"2.12.11\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.13.0\",\n                            \"lessThan\": \"2.13.7\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv","https://github.com/kumahq/kuma/pull/16777","https://developer.konghq.com/mesh/changelog/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-18679","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-18679","identifiers":["CVE-2026-18679"]},"retained":false,"historicalAffected":[]}],"coverage":[]}