CVE-2026-18675: Kuma Control Plane DoS Vulnerability

CVE-2026-18675 Overview

CVE-2026-18675 affects the dataplane token validator in kuma-cp, the control plane component of the Kuma service mesh. The validator performs an unchecked Go type assertion on the JSON Web Token (JWT) kid header. When an attacker supplies a token whose kid value is a JSON number, the value decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check executes. The panic terminates the entire kuma-cp process, taking down the HTTP API, health and readiness endpoints, and xDS server. Unauthenticated access to the dataplane gRPC server is sufficient to trigger the crash with a malformed token.

Critical Impact

Unauthenticated adjacent-network attackers can crash kuma-cp, disrupting the service mesh control plane and xDS distribution. Sustained outages require repeated requests.

Affected Products

• Kuma service mesh (kuma-cp control plane) — see Kuma Security Advisory GHSA-5mxq-7xq4-3vx8
• Kong Mesh — see Kong Mesh Changelog
• Deployments exposing the dataplane gRPC server without authentication

Discovery Timeline

• 2026-08-12 - CVE-2026-18675 published to NVD
• 2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18675

Vulnerability Analysis

The defect resides in the dataplane token validator inside kuma-cp. When parsing a JWT, the validator reads the kid (key identifier) header and performs a Go type assertion expecting a string. The assertion is unchecked, meaning it uses the single-return-value form that panics on type mismatch rather than the safe two-value form that returns an ok boolean.

A JWT header value in JSON can be any valid JSON type. When kid is submitted as a JSON number, Go's encoding/json package decodes it into an interface{} holding a float64. The subsequent string assertion fails and raises a runtime panic. Because the panic is not recovered, it propagates upward and terminates the entire kuma-cp process, tearing down the HTTP API, health and readiness endpoints, and the xDS control channel used by dataplane proxies.

Root Cause

The root cause is unchecked error handling around a Go type assertion, classified as [CWE-248] Uncaught Exception. The validator trusts attacker-controlled JWT header content before validating token structure, signature, or issuer. Type validation of header fields must occur before assertion, and panics must be recovered at request boundaries.

Attack Vector

An attacker with adjacent network access to the dataplane gRPC server sends a crafted JWT whose kid header is a JSON number rather than a string. No authentication or prior authorization is required because the panic fires during token parsing, before signature verification. A single malformed request produces a transient outage; sustaining the outage requires the attacker to send repeated requests as kuma-cp restarts.

See the upstream patches in Kuma Pull Request #17465, #17467, #17468, #17469, #17470, #17471, and #17472 for the corrected type-safe parsing logic.

Detection Methods for CVE-2026-18675

Indicators of Compromise

• Repeated kuma-cp process crashes or container restarts with Go runtime panic messages referencing type assertion failures in the token validator.
• Bursts of failed dataplane gRPC connections coinciding with control plane unavailability on health and readiness endpoints.
• Loss of xDS updates to Envoy dataplane proxies, followed by stale configuration warnings from mesh workloads.

Detection Strategies

• Monitor kuma-cp logs for panic: interface conversion messages tied to JWT parsing stack frames.
• Alert on abnormal restart counts of kuma-cp pods in Kubernetes, particularly restarts clustered within short time windows.
• Inspect gRPC access telemetry for unauthenticated clients submitting malformed JWTs to the dataplane token endpoint.

Monitoring Recommendations

• Track uptime and readiness probe status for every kuma-cp replica and alert on flapping.
• Correlate control plane crash events with source IP data from network flow logs to identify the origin of malformed requests.
• Enable structured logging on the dataplane token validator so parsing errors and panics are attributable to specific request identifiers.

How to Mitigate CVE-2026-18675

Immediate Actions Required

• Upgrade kuma-cp to a patched Kuma or Kong Mesh release listed in the Kuma Security Advisory GHSA-5mxq-7xq4-3vx8.
• Restrict network exposure of the dataplane gRPC server to trusted dataplane subnets using network policies or firewall rules.
• Deploy multiple kuma-cp replicas behind a load balancer so a single panic does not eliminate control plane availability.

Patch Information

The Kuma maintainers merged fixes across pull requests #17465 through #17472, replacing unchecked type assertions with the safe two-value form and rejecting JWT headers whose kid is not a string. Kong Mesh users should reference the Kong Mesh Changelog for the corresponding patched version.

Workarounds

• Place an authenticating proxy or mutual TLS gateway in front of the dataplane gRPC endpoint to reject unauthenticated clients before requests reach kuma-cp.
• Apply Kubernetes NetworkPolicies limiting gRPC access to known dataplane workload identities.
• Configure aggressive process supervision so kuma-cp restarts quickly after a crash, minimizing outage windows until patching completes.

# Kubernetes NetworkPolicy restricting dataplane gRPC access to mesh workloads
# Refer to Kuma Security Advisory GHSA-5mxq-7xq4-3vx8 for authoritative guidance