PT-2026-76636 · Kong+1 · Kong Mesh+1
CVSS v4.0
7.0
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Kong Mesh (affected versions not specified)
Description
A cross-zone isolation bypass exists in the global control plane due to how resources are attributed during the zone-to-global KDS sync. The system uses the sender-controlled
ControlPlane.Identifier instead of the authenticated zone identity derived from the connection. This allows an authenticated zone to inject, attribute, and overwrite resources in another zone's namespace across the entire mesh. The issue originates from the KDS sync code in Kuma, which serves as the foundation for the Kong Mesh control plane.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Incorrect Authorization
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Kong Mesh
Kuma