The readiness service of the Kong Mesh data plane exposes the Envoy admin API on TCP port 9902 without authentication. Attackers who can reach this port can read Envoy’s configuration files, cluster and listener lists, runtime statistics, and the mesh trust bundle, though they cannot perform destructive actions such as modifying the configuration. This oversight leads to a read‑only information disclosure vulnerability, allowing attackers to gain insight into the mesh topology and potentially use that knowledge for further attacks.

Vendors and products impacted include Kong Inc. – Kong Mesh. Any installation of Kong Mesh running a data plane (kuma-dp) that uses the default Envoy admin API on a Unix domain socket and exposes the readiness service on port 9902 is affected; earlier versions than 2.14.2 are vulnerable, while 2.14.2 and later fix the issue by restricting the readiness reporter to only /ready and keeping the Envoy admin API bound exclusively to the Unix domain socket.

The CVSS score of 5.3 indicates moderate severity. The vulnerability can be exploited by any pod or entity with network reachability to port 9902, which is typically available within the cluster network. No authentication is required, and the attack path is straightforward local network access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the threat is still meaningful due to the exposure of sensitive configuration data.