CVE-2026-18674

Name of the Vulnerable Software and Affected Versions Kong Mesh (affected versions not specified)

Description A cross-zone isolation bypass exists in the global control plane due to how resources are attributed during the zone-to-global KDS sync. The system uses the sender-controlled ControlPlane.Identifier instead of the authenticated zone identity derived from the connection. This allows an authenticated zone to inject, attribute, and overwrite resources in another zone's namespace across the entire mesh. The issue originates from the KDS sync code in Kuma, which serves as the foundation for the Kong Mesh control plane.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.