Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Kong Mesh 2.11.14, 2.12.11 and 3 more versions Clear all filters
TI-2026-15306 CVE-2026-18679 · GHSA-wc82-hqx6-g35q

Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

Priority LOW 25

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that…

CVSS 4.0MEDIUM 5.8 Adjacent network No auth No interaction EPSS 0.00158 Published 2026-08-12 Fixed in 2.7.26, 2.9.16 +3 CWE-295
TI-2026-15305 CVE-2026-18678 · GHSA-26pg-x7g5-9g43

Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

Priority LOW 24

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

CVSS 4.0MEDIUM 5.5 Adjacent network No auth User interaction EPSS 0.00128 Published 2026-08-12 Fixed in 2.7.26, 2.9.16 +3 CWE-295