Kong Inc. Mesh vulnerabilities
- kong inc. meshKong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier7.0 High
- kong inc. meshKong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity6.0 Medium
- kong inc. meshKong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid5.3 Medium
- kong inc. meshKong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication5.3 Medium
- kong inc. meshKong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured5.8 Medium
- kong inc. meshKong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured5.5 Medium
- kong inc. meshKong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin5.1 Medium