CVE-2026-18673
Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 12, 2026
- Updated
- Aug 13, 2026
- Reserved
- Aug 3, 2026
Description
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication.
An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | Kong |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Kong MeshKong Inc. |
|
References
- Upstream advisory GHSA-r9pv-x3pm-4r2wvendor-advisory
- kumahq/kuma#17317 (master)patch
- kumahq/kuma#17418 (release-2.14 backport)patch
- Kong Product Security Advisoriesvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.