CVE-2026-18679
Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured
CVSS score
5.8
EPSS probability
%0.2
Risk score
0.0
Published
2 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.0
CVE-2026-18674
Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier
KI
Patch verifiedEPSS %1
5.3
CVE-2026-18675
Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid
KI
Patch verifiedEPSS %1
6.0
CVE-2026-18677
Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity
KI
Patch verifiedEPSS %0
5.3
CVE-2026-18673
Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
KI
Patch verifiedEPSS %0
5.1
CVE-2026-18676
Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin
KI
Patch verifiedEPSS %0
5.5
CVE-2026-18678
Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured
KI
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-18679"