CVEs published by Kong

CVEs published by Kong (CVE Numbering Authority). 7 tracked.

CVE-2026-17578 LOW 2.3 Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP
CVE-2026-18675 MEDIUM 5.3 The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header
CVE-2026-18677 MEDIUM 6.0 In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the data
CVE-2026-18673 MEDIUM 5.3 When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readine
CVE-2026-18676 MEDIUM 5.1 The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpa
CVE-2026-18679 MEDIUM 5.8 When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the dat
CVE-2026-18678 MEDIUM 5.5 When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl di