CVE-2026-18678: CWE-295 Improper Certificate Validation in Kong Inc. Kong Mesh
CVE-2026-18678 is a medium severity vulnerability in Kong Inc.'s Kong Mesh product. It occurs when an operator adds an HTTPS control plane profile to kumactl without specifying a CA certificate, causing TLS verification to be disabled. This leads to API tokens being sent over an unverified connection, allowing a network attacker to intercept these tokens and potentially act on the control plane with the user's privileges.
AI Analysis
Technical Summary
This vulnerability (CWE-295) arises from improper certificate validation in Kong Mesh's kumactl tool. When an HTTPS control plane profile is configured without a CA certificate, TLS verification is disabled, causing API tokens to be transmitted over an unverified channel. An attacker positioned on the network path can intercept these tokens and impersonate the user or admin to interact with the control plane.
Potential Impact
An attacker with network access between the operator and the control plane can intercept API tokens due to disabled TLS verification. This enables the attacker to perform unauthorized actions on the control plane with the privileges of the intercepted user or admin tokens. The vulnerability affects confidentiality and integrity of control plane communications.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Operators should ensure that a valid CA certificate is provided when adding an HTTPS control plane profile to kumactl to avoid disabling TLS verification. Until an official fix is available, avoid configurations that omit CA certificates to prevent token interception.
CVE-2026-18678: CWE-295 Improper Certificate Validation in Kong Inc. Kong Mesh
Description
CVE-2026-18678 is a medium severity vulnerability in Kong Inc.'s Kong Mesh product. It occurs when an operator adds an HTTPS control plane profile to kumactl without specifying a CA certificate, causing TLS verification to be disabled. This leads to API tokens being sent over an unverified connection, allowing a network attacker to intercept these tokens and potentially act on the control plane with the user's privileges.
CVSS v4.0
Score 5.5medium
Affected software
pkg:github/kumahq/kumaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-295) arises from improper certificate validation in Kong Mesh's kumactl tool. When an HTTPS control plane profile is configured without a CA certificate, TLS verification is disabled, causing API tokens to be transmitted over an unverified channel. An attacker positioned on the network path can intercept these tokens and impersonate the user or admin to interact with the control plane.
Potential Impact
An attacker with network access between the operator and the control plane can intercept API tokens due to disabled TLS verification. This enables the attacker to perform unauthorized actions on the control plane with the privileges of the intercepted user or admin tokens. The vulnerability affects confidentiality and integrity of control plane communications.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Operators should ensure that a valid CA certificate is provided when adding an HTTPS control plane profile to kumactl to avoid disabling TLS verification. Until an official fix is available, avoid configurations that omit CA certificates to prevent token interception.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Kong
- Date Reserved
- 2026-08-03T15:20:46.760Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7cc1f3bf8831d539fe73fd
Added to database: 08/12/2026, 18:56:51 UTC
Last enriched: 08/12/2026, 19:15:45 UTC
Last updated: 08/12/2026, 19:15:45 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.