Description
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.



The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token



A single request is a transient interruption; sustaining an outage requires repeated requests.
Published: 2026-08-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unchecked type assertion in the dataplane token validator causes a panic when the JWT kid header is a numeric value. The panic aborts the entire control plane, stopping the HTTP API, health checks, readiness probes, and the xDS gRPC service before any authentication or authorization step. This leads to a denial of service that can interrupt service availability.

Affected Systems

Kong Mesh deployments using the control plane (kuma-cp) are affected. The vulnerability exists in all supported versions of Kong Mesh up to the releases prior to 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, and 2.14.2 – the versions indicated by the vendor for patching.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate severity, and the EPSS score is unavailable. The issue is not listed in the CISA KEV catalog. Attackers can trigger the crash by sending a single malformed token over the unauthenticated dataplane gRPC port; to sustain an outage repeated requests are required. Network isolation or limiting access to the dataplane port can mitigate exposure until a patch is applied.

Generated by OpenCVE AI on August 12, 2026 at 23:34 UTC.

Remediation

Vendor Solution

Upgrade to Kong Mesh 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10 or 2.14.2, whichever matches your release line. In patched versions the validator rejects a non-string kid header and the dataplane server recovers from handler panics.

Vendor Workaround

Restrict network access to the dataplane (xDS) gRPC port to trusted data planes.

OpenCVE Recommended Actions

  • Upgrade Kong Mesh to a patched release (2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, or 2.14.2) that validates the kid header and prevents the panic.
  • Restrict network access to the dataplane (xDS) gRPC port so that only trusted data plane instances can reach it, as a vendor‑provided workaround.
  • Enable monitoring of control plane crash logs to detect and respond to unsuccessful crash attempts until the patch is applied.

Generated by OpenCVE AI on August 12, 2026 at 23:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Konghq
Konghq kong Mesh
Vendors & Products Konghq
Konghq kong Mesh

Wed, 12 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.
Title Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid
Weaknesses CWE-248
CWE-704
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Konghq Kong Mesh
cve-icon MITRE

Status: PUBLISHED

Assigner: Kong

Published:

Updated: 2026-08-13T15:28:44.341Z

Reserved: 2026-08-03T15:20:42.168Z

Link: CVE-2026-18675

cve-icon Vulnrichment

Updated: 2026-08-13T15:28:35.818Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-12T19:17:30.650

Modified: 2026-08-31T19:22:43.473

Link: CVE-2026-18675

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:48:10Z

Weaknesses
  • CWE-248

    Uncaught Exception

  • CWE-704

    Incorrect Type Conversion or Cast