CVE-2026-18679: Kong Inc. Kong Mesh, слаба криптография

Описание

Оригинално описание

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.

Засегнати продукти

• Kong Inc. Kong Mesh: преди 2.7.26; 2.8.0 преди 2.9.16; 2.10.0 преди 2.11.14; 2.12.0 преди 2.12.11; 2.13.0 преди 2.13.7

Вид слабост

• CWE-295 Неправилна валидация на сертификат

История

Други уязвимости в Kong Inc. Kong Mesh

• 7.0CVE-2026-18674
• 5.5CVE-2026-18678
• 6.0CVE-2026-18677
• 5.1CVE-2026-18676
• 5.3CVE-2026-18675

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-18679
• https://nvd.nist.gov/vuln/detail/CVE-2026-18679
• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
• https://github.com/kumahq/kuma/pull/16777
• https://developer.konghq.com/mesh/changelog/