CVE-2026-18677

Name of the Vulnerable Software and Affected Versions Kong Mesh (affected versions not specified)

Description In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp only validates that label when the dataplane token is bound to a workload. Since workload binding is optional, a dataplane using a tags-bound token can register with the kuma.io/workload label set to any value, allowing it to obtain the SPIFFE identity of another workload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.