CVE-2026-18673

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.

CVSS

No CVSS.

References

Link	Resource
https://developer.konghq.com/mesh/changelog/
https://github.com/kumahq/kuma/pull/17317
https://github.com/kumahq/kuma/pull/17418
https://github.com/kumahq/kuma/security/advisories/GHSA-r9pv-x3pm-4r2w

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Cuando kuma-dp está configurado con la API de administración de Envoy en un socket de dominio Unix, que es el predeterminado, su servicio de preparación en el puerto TCP 9902 - enlazado a todas las interfaces - reenvía casi toda la API de administración de Envoy a cualquier llamador que pueda alcanzar el puerto, sin autenticación. Un atacante con acceso de red al puerto 9902 de un plano de datos, por ejemplo, otro pod en la red del clúster, puede leer la configuración de Envoy y del plano de datos sin credenciales: volcados de configuración, listas de clústeres y oyentes, estadísticas y el paquete de confianza de la malla. La exposición es de solo lectura: las acciones administrativas destructivas de Envoy están bloqueadas y las claves privadas no están expuestas.

Information

Published : 2026-08-12 19:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-18673

Mitre link : CVE-2026-18673

CVE.ORG link : CVE-2026-18673

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-18673", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18673", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:53:48.881667Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "affectedData": [{"vendor": "Kong Inc.", "modules": ["kuma-dp"], "product": "Kong Mesh", "versions": [{"status": "affected", "version": "2.14.0", "lessThan": "2.14.2", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T19:17:30.480", "references": [{"url": "https://developer.konghq.com/mesh/changelog/", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}, {"url": "https://github.com/kumahq/kuma/pull/17317", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}, {"url": "https://github.com/kumahq/kuma/pull/17418", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}, {"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-r9pv-x3pm-4r2w", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication.\n\n\n\nAn attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed."}, {"lang": "es", "value": "Cuando kuma-dp est\u00e1 configurado con la API de administraci\u00f3n de Envoy en un socket de dominio Unix, que es el predeterminado, su servicio de preparaci\u00f3n en el puerto TCP 9902 - enlazado a todas las interfaces - reenv\u00eda casi toda la API de administraci\u00f3n de Envoy a cualquier llamador que pueda alcanzar el puerto, sin autenticaci\u00f3n.\n\nUn atacante con acceso de red al puerto 9902 de un plano de datos, por ejemplo, otro pod en la red del cl\u00faster, puede leer la configuraci\u00f3n de Envoy y del plano de datos sin credenciales: volcados de configuraci\u00f3n, listas de cl\u00fasteres y oyentes, estad\u00edsticas y el paquete de confianza de la malla. La exposici\u00f3n es de solo lectura: las acciones administrativas destructivas de Envoy est\u00e1n bloqueadas y las claves privadas no est\u00e1n expuestas."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}