Kong Mesh 2.14.0 contains a vulnerability where the kuma-dp component's readiness service listens on TCP port 9902 bound to all interfaces and forwards nearly the entire Envoy admin API without authentication. This enables unauthorized actors with network access to that port to retrieve sensitive information such as Envoy and data plane configurations, cluster and listener details, statistics, and the mesh trust bundle. The vulnerability is due to the forwarding of the Envoy admin API, which is normally accessible only via a Unix domain socket, to a TCP port without access controls. Although the exposure allows read-only access, it leaks sensitive configuration data that could aid further attacks. Destructive admin actions and private keys remain protected.

An attacker with network access to TCP port 9902 on the data plane can read sensitive configuration information from the Envoy admin API without credentials. This includes configuration dumps, cluster and listener lists, statistics, and the mesh trust bundle. The exposure is limited to read-only data; no destructive actions or private key disclosures are possible. This information disclosure could aid attackers in reconnaissance or planning further attacks within the cluster environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to TCP port 9902 on the data plane to trusted entities only to prevent unauthorized access. Monitor vendor communications for updates or official fixes.