CVE-2026-18675
Received
Received - Intake
Type Confusion in Kuma-CP JWT Token Validation
Vulnerability report for CVE-2026-18675, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-12
Last updated on: 2026-08-12
Assigner: Kong
Description
Description
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.
The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token
A single request is a transient interruption; sustaining an outage requires repeated requests.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kumahq | kuma | From 2.14.0 (inc) to 2.14.1 (inc) |
| kong | kong_mesh | From 2.7.28 (inc) to 2.14.3 (inc) |
| kuma | kuma-cp | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-704 | The product does not correctly convert an object, resource, or structure from one type to a different type. |
| CWE-248 | An exception is thrown from a function, but it is not caught. |
