CVE-2026-18673

Name of the Vulnerable Software and Affected Versions kuma-dp (affected versions not specified)

Description When configured with the Envoy admin API on a Unix domain socket, the readiness service on TCP port 9902 forwards most of the Envoy admin API to any caller with network access without requiring authentication. An attacker, such as another pod on the cluster network, can read the Envoy and data plane configuration, including config dumps, cluster and listener lists, stats, and the mesh trust bundle. This exposure is read-only, as destructive actions are blocked and private keys are not exposed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.