CVE-2026-18673
Received Received - Intake

Information Disclosure in kuma-dp via Envoy Admin API

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Kong

Description
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-13
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-18673
EUVD
EUVD-2026-57398

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
kumahq kuma From 2.14.0 (inc) to 2.14.1 (inc)
kumahq kuma 2.14.2
konghq kong_mesh From 2.7.28 (inc) to 2.14.3 (inc)
konghq kong_mesh 2.14.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18673 affects the kuma-dp readiness service in Kuma versions 2.14.0 to 2.14.1. When the Envoy admin API is configured on a Unix domain socket, the readiness service on TCP port 9902 exposes almost the entire Envoy admin API to any caller with network access to the port without authentication. This allows reading sensitive configurations like config dumps, cluster and listener lists, stats, and mesh trust bundles, but does not expose private keys or allow destructive actions.

Detection Guidance

Check if TCP port 9902 is accessible on any system running kuma-dp versions 2.14.0 to 2.14.1. Use commands like 'nc -zv <target-ip> 9902' or 'curl -v http://<target-ip>:9902/' to test connectivity. If the port responds, verify if endpoints like /config_dump, /stats, or /clusters are accessible without authentication.

Impact Analysis

An attacker with network access to port 9902, such as another pod on the cluster network, can read internal Envoy and data-plane configurations without credentials. This includes sensitive data like cluster configurations, listener lists, and mesh trust bundles, potentially leading to information disclosure and unauthorized access to system details.

Compliance Impact

This vulnerability may violate compliance requirements for data protection and confidentiality, such as GDPR's data processing principles or HIPAA's safeguards for protected health information, due to unauthorized exposure of sensitive system configurations and data.

Mitigation Strategies

Upgrade kuma-dp to version 2.14.2 or later. If upgrading is not possible, restrict network access to port 9902 using Kubernetes NetworkPolicy or firewall rules. Ensure only trusted workloads can reach the port.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart