Answer in brief
CVE-2026-18675 records a Medium severity (CVSS 5.3) vulnerability in Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid. The current sources do not mark it as known exploited. The current feed maps Kong Inc./Kong Mesh (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Kong Inc./Kong Mesh (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Kong Inc./Kong Meshgeneric | >=0 <2.7.29 || >=2.8.0 <2.9.19 || >=2.10.0 <2.11.18 || >=2.12.0 <2.12.14 || >=2.13.0 <2.13.10 || >=2.14.0 <2.14.2 | 2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, 2.14.2 |
Published upstream
Aug 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 12, 2026
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.
Quoted source text, attributed separately from HOL analysis.