CVE-2026-18673: Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication.
An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kong Meshto a version that resolves this vulnerability.Fixed in 2.14.2 - Compensating control
If you cannot upgrade immediately, restrict network access to the data-plane port 9902 (kuma-dp readiness service) so only intended peers can reach it, since kuma-dp listens on TCP port 9902 bound to all interfaces and forwards the Envoy admin API without authentication.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18673?
CVE-2026-18673 has a risk score of 47, indicating a moderate severity level.
How do I fix CVE-2026-18673?
To fix CVE-2026-18673, ensure that the kuma-dp readiness service is not exposing the Envoy admin API on TCP port 9902 without proper authentication.
What systems are affected by CVE-2026-18673?
CVE-2026-18673 affects the Kong Mesh kuma-dp readiness service when configured with the Envoy admin API.
What kind of information can an attacker access through CVE-2026-18673?
An attacker can access almost the entire Envoy admin API, potentially leading to sensitive information leakage.
Is authentication required for the Envoy admin API in CVE-2026-18673?
No, CVE-2026-18673 exposes the Envoy admin API without authentication, making it vulnerable to unauthorized access.