The vulnerability arises from the dataplane token validator in kuma-cp performing an unchecked Go type assertion on the JWT kid header. When the kid is a JSON number, it decodes as a float64, triggering a runtime panic before any signature, claims, or authorization checks occur. This panic terminates the entire kuma-cp process, including the HTTP API, health and readiness endpoints, and xDS. An attacker can cause this by sending a malformed token to the dataplane gRPC server without authentication. While a single request causes only a transient interruption, repeated requests can sustain an outage.

The impact is a denial of service condition where the kuma-cp process and its associated services crash and become unavailable. This affects the HTTP API, health and readiness endpoints, and xDS functionality. The vulnerability can be triggered without authentication, increasing the risk of exploitation. However, the outage is transient per request and requires repeated requests to sustain.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data. Until a patch is available, limiting unauthenticated access to the dataplane gRPC server may reduce exposure.