TI-2026-15301 Aliases CVE-2026-18674 GHSA-fxcr-qwx6-5h7q

Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

LOW 32CWE-345Published 2026-08-17 · Updated 2026-08-17

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone. The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide. The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00558 46th percentileScored 2026-11-07

Fix Fixed Kong Mesh (Kong Inc.): 2.7.29, 2.9.19, 2.11.18 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Kong Inc.	Kong Mesh	before 2.7.29; 2.8.0 to before 2.9.19; 2.10.0 to before 2.11.18; 2.12.0 to before 2.12.14; 2.13.0 to before 2.13.10; 2.14.0 to before 2.14.2	2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, 2.14.2	Patch available	CNA

Kong Mesh VendorKong Inc. Affected before 2.7.29; 2.8.0 to before 2.9.19; 2.10.0 to before 2.11.18; 2.12.0 to before 2.12.14; 2.13.0 to before 2.13.10; 2.14.0 to before 2.14.2 Fixed in 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, 2.14.2 Patch available CNA

Remediation

Fix · CNA Kong Mesh (Kong Inc.) Fixed in 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, 2.14.2

Timeline

2026-10-02 Threatist record created from CVE-2026-18674
2026-10-03 Alias added: GHSA-fxcr-qwx6-5h7q

References

Patch 7

Advisory 1

Upstream advisory GHSA-m58j-fjmc-h3g4

Other 1

Kong Mesh Changelog

TI-2020-17871 The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank… CVSS 3.1CRITICAL 9.8
TI-2025-00925 Arbitrary Code Execution in Kong Insomnia Desktop Application CVSS 4.0CRITICAL 9.3
TI-2026-12562 Kong API Gateway Enterprise: SAML Authentication bypass CVSS 4.0HIGH 7.7
TI-2026-12561 Kong API Gateway Enterprise: JWT Algorithm-Confusion CVSS 4.0HIGH 7.7
TI-2020-18854 Kong lua-multipart multipart.lua is_header redos CVSS 3.1HIGH 7.5
TI-2026-70893 SQL injection in Kong Gateway clustering communication CVSS 4.0HIGH 7.5

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences