CVE-2026-18677CWE-290

CVE-2026-18677

published August 12, 2026

CVSS
6.0
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.

The record
Technical detail
CVSS
6.0 · NONE
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-08-12T23:17Z
References (5)
https://developer.konghq.com/mesh/changelog/ · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/17474 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/17502 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/17503 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/security/advisories/GHSA-744g-c785-x65q · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
EPSS history
Timeline
  • 12 AUG 18:47Z
    Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity
    cvelistv5