The vulnerability arises from Kong Mesh's global control plane trusting the in-band ControlPlane.Identifier provided by the sender during zone-to-global KDS synchronization instead of verifying the authenticated zone identity derived from the connection. This design flaw, originating in the Kuma open-source KDS sync code, enables an attacker with credentials from a single enrolled zone to impersonate another zone and manipulate resources across zones within the mesh, bypassing intended isolation controls.

An attacker with credentials for one enrolled zone can inject, attribute, and overwrite resources in the namespace of another zone across the entire mesh. This cross-zone isolation bypass compromises the integrity and isolation guarantees of the mesh environment, potentially allowing unauthorized configuration changes or resource manipulation across zones.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor Kong Inc.'s advisories for updates and consider restricting zone credentials and access until a fix is available.