CVE-2026-18675

Awaiting Analysis Awaiting Analysis - Queue

Type Confusion in Kuma-CP JWT Token Validation

Publication date: 2026-08-12

Last updated on: 2026-08-31

Assigner: Kong

Description

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-31

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18675

EUVD

EUVD-2026-57421

Affected Vendors & Products

Vendor	Product	Version / Range
kumahq	kuma	From 2.14.0 (inc) to 2.14.1 (inc)
kong	kong_mesh	From 2.7.28 (inc) to 2.14.3 (inc)
kuma	kuma-cp	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-704	The product does not correctly convert an object, resource, or structure from one type to a different type.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability involves a denial-of-service condition in Kuma's control plane (kuma-cp). The dataplane token validator performs an unchecked Go type assertion on the JWT 'kid' header. If the 'kid' is a JSON number (decoded as float64), it triggers a runtime panic before signature or authorization checks. The panic crashes the entire kuma-cp process, including HTTP API, health endpoints, and xDS. An unauthenticated attacker can exploit this by sending a malformed token to the dataplane gRPC server.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in the kuma-cp process or gRPC server. Check logs for panics related to JWT token validation or gRPC handler failures. Use commands like 'journalctl -u kuma-cp' or 'kubectl logs <kuma-cp-pod>' to inspect logs for stack traces indicating a float64 'kid' header causing a panic.

Impact Analysis

The impact is a denial-of-service where the control plane crashes, disrupting API access, health checks, and xDS functionality. Data planes continue operating with their last-known configuration, but repeated attacks could sustain the outage. The attack requires network access to the dataplane gRPC server, typically on the mesh or cluster network.

Compliance Impact

This vulnerability primarily impacts availability by causing denial-of-service conditions in the Kuma control plane. It does not directly affect confidentiality or integrity of data. Compliance with GDPR or HIPAA depends on the system's ability to maintain service availability and protect data during outages. Repeated exploitation could lead to prolonged service disruptions, potentially violating availability requirements in these standards.

Mitigation Strategies

Upgrade Kuma control-plane to patched versions (2.7.29, 2.9.19, 2.11.18, 2.12.14, 2.13.10, or 2.14.2). Restrict network access to the dataplane gRPC port to trusted data planes only. Monitor for repeated crashes indicating exploitation attempts.

Hi! I’m here to help you understand CVE-2026-18675. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70