Advisories · Technology
Kong Inc. Kong Mesh.
Every CVE that names Kong Inc. Kong Mesh among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.0 High
Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier
- Kong Inc. Kong Mesh
- Broken access control
- CWE-345
- CVSS 6.0 Medium
Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity
- Kong Inc. Kong Mesh
- Authentication bypass
- CVSS 5.3 Medium
Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid
- Kong Inc. Kong Mesh
- CWE-248
- CWE-704
- CVSS 5.3 Medium
Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
- Kong Inc. Kong Mesh
- Information disclosure
- Authentication bypass