Kanywst

**Name of the Vulnerable Software and Affected Versions** Kong Mesh (affected versions not specified) **Description** In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's `kuma.io/workload` label, the XDS authenticator in kuma-cp only validates that label when the dataplane token is bound to a workload. Since workload binding is optional, a dataplane using a tags-bound token can register with the `kuma.io/workload` label set to any value, allowing it to obtain the SPIFFE identity of another workload. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.