Description
In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.
Published: 2026-08-12
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In Kong Mesh running in universal mode, a dataplane token that is not bound to a workload can register with any kuma.io/workload value when the MeshIdentity’s SPIFFE ID path template derives from that label. This flaw allows an attacker to obtain the SPIFFE identity of an arbitrary workload, effectively bypassing authentication and potentially allowing unauthorized access to services that rely on SPIFFE trust relationships.

Affected Systems

The vulnerability affects Kong Mesh versions prior to 2.13.10 for the 2.13.x line and prior to 2.14.2 for the 2.14.x line. Any installation using universal mode with MeshIdentity configurations that derive the SPIFFE path from the kuma.io/workload label is impacted.

Risk and Exploitability

The CVSS score of 6 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The attack vector is internal to the cluster or via network paths that can reach the dataplane authentication endpoint. Authenticating a dataplane requires that a service account or token can reach the Kuma control‑plane. No specific credential or elevation requirements are stated, but the vulnerability allows the attacker to impersonate any workload identity once the attacker controls or creates a compliant dataplane token.

Generated by OpenCVE AI on August 12, 2026 at 23:53 UTC.

Remediation

Vendor Solution

Upgrade to Kong Mesh 2.13.10 or 2.14.2, whichever matches your release line. In patched versions a dataplane whose identity derives from the kuma.io/workload label requires a workload-bound token; an unbound tags-only token is rejected at XDS authentication. Kubernetes mode and universal templates that do not reference the workload label keep working with unbound tokens.

Vendor Workaround

Issue workload-bound dataplane tokens for every dataplane whose identity derives from the kuma.io/workload label. A workload-bound token constrains that label to the bound value, so a mismatched label is rejected at authentication.

OpenCVE Recommended Actions

  • Upgrade to Kong Mesh 2.13.10 or 2.14.2, depending on your release line, which enforces workload-bound tokens for dataplanes whose identity derives from the kuma.io/workload label.
  • If immediate upgrade is not possible, issue workload-bound dataplane tokens for every dataplane that derives its identity from the kuma.io/workload label, ensuring the token cannot be used to claim other workloads.
  • Configure the control plane to reject any unbound token for dataplanes where the MeshIdentity’s SPIFFE ID path template uses the kuma.io/workload label, and verify that the XDS authentication process enforces this rule.

Generated by OpenCVE AI on August 12, 2026 at 23:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Konghq
Konghq kong Mesh
Vendors & Products Konghq
Konghq kong Mesh

Wed, 12 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.
Title Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity
Weaknesses CWE-290
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Konghq Kong Mesh
cve-icon MITRE

Status: PUBLISHED

Assigner: Kong

Published:

Updated: 2026-08-13T14:49:27.614Z

Reserved: 2026-08-03T15:20:45.630Z

Link: CVE-2026-18677

cve-icon Vulnrichment

Updated: 2026-08-13T14:49:24.390Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-12T19:17:31.063

Modified: 2026-08-31T19:22:43.473

Link: CVE-2026-18677

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:48:07Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing