TI-2026-15302 Aliases CVE-2026-18675 GHSA-7gh2-244h-962w

Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid

LOW 25CWE-248Published 2026-08-12 · Updated 2026-08-13

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00561 46th percentileScored 2026-11-07

Fix Fixed Kong Mesh (Kong Inc.): 2.7.29, 2.9.19, 2.11.18 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Kong Inc.	Kong Mesh	before 2.7.29; 2.8.0 to before 2.9.19; 2.10.0 to before 2.11.18; 2.12.0 to before 2.12.14; 2.13.0 to before 2.13.10; 2.14.0 to before 2.14.2	2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, 2.14.2	Patch available	CNA

Kong Mesh VendorKong Inc. Affected before 2.7.29; 2.8.0 to before 2.9.19; 2.10.0 to before 2.11.18; 2.12.0 to before 2.12.14; 2.13.0 to before 2.13.10; 2.14.0 to before 2.14.2 Fixed in 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, 2.14.2 Patch available CNA

Remediation

Fix · CNA Kong Mesh (Kong Inc.) Fixed in 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, 2.14.2

Timeline

2026-10-02 Threatist record created from CVE-2026-18675
2026-10-03 Alias added: GHSA-7gh2-244h-962w

References

Patch 7

Advisory 1

Upstream advisory GHSA-5mxq-7xq4-3vx8

Other 1

Kong Product Security Advisories

TI-2020-17871 The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank… CVSS 3.1CRITICAL 9.8
TI-2025-00925 Arbitrary Code Execution in Kong Insomnia Desktop Application CVSS 4.0CRITICAL 9.3
TI-2026-12562 Kong API Gateway Enterprise: SAML Authentication bypass CVSS 4.0HIGH 7.7
TI-2026-12561 Kong API Gateway Enterprise: JWT Algorithm-Confusion CVSS 4.0HIGH 7.7
TI-2020-18854 Kong lua-multipart multipart.lua is_header redos CVSS 3.1HIGH 7.5
TI-2026-70893 SQL injection in Kong Gateway clustering communication CVSS 4.0HIGH 7.5

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences