CVE-2026-18674
Received Received - Intake

Zone Identity Spoofing in Kong Mesh Control Plane

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: Kong

Description
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone. The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide. The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-18674
EUVD
EUVD-2026-60160

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kuma kuma to 2.14.2 (exc)
kong kong_mesh From 2.7.28 (inc) to 2.14.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Kong Mesh's global control plane allows a zone with valid credentials to spoof another zone's identity during zone-to-global KDS sync. Resources are attributed using sender-controlled values instead of the authenticated zone identity, enabling cross-zone isolation bypass. An attacker can inject, overwrite, or attribute resources in another zone's namespace mesh-wide.

Detection Guidance

Detecting this vulnerability requires checking Kong Mesh or Kuma control plane logs for zone-to-global KDS sync inconsistencies. Look for mismatches between sender-provided ControlPlane.Identifier or kuma.io/zone tags and the authenticated client-id in KDS stream metadata. Enable debug logging for KDS components and monitor for the kds_zone_attribution_rewrites_total metric introduced in the fix.

Impact Analysis

An attacker controlling a single enrolled zone can manipulate service discovery, redirect traffic, or poison data across zones. This could disrupt mesh operations, enable unauthorized access to zone-specific resources, or cause service outages by misrouting requests to incorrect endpoints.

Compliance Impact

The vulnerability allows a zone with valid credentials to spoof another zone's identity, enabling unauthorized access or misrouting of traffic between zones. This could lead to data exposure or integrity issues, potentially violating GDPR's data protection requirements or HIPAA's access controls. The cross-zone isolation bypass undermines network segmentation and access controls required by these regulations.

Mitigation Strategies

Upgrade to a patched version of Kong Mesh (2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, or 2.14.2 or later). If immediate upgrade is not possible, restrict zone enrollment and protect zone tokens as workarounds. Monitor logs for cross-zone resource attribution anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart