CVE-2026-18675 in Mesh
Summary
by MITRE • 08/12/2026
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.
The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token
A single request is a transient interruption; sustaining an outage requires repeated requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability described represents a critical denial of service weakness in the kuma control plane's dataplane token validation mechanism, specifically within the JWT kid header processing functionality. This issue stems from an unchecked Go type assertion that occurs when validating JSON Web Tokens used for dataplane authentication. The flaw manifests when a JWT contains a kid (key identifier) header value that is formatted as a JSON number rather than a string, which causes the Go runtime to perform an implicit type conversion that results in a panic condition.
The technical implementation of this vulnerability exploits Go's dynamic typing behavior during JSON unmarshaling operations. When the kuma-cp component encounters a JWT with a numeric kid header, it attempts to assert the type without proper validation, causing the system to decode the value as a float64 instead of the expected string format. This unchecked type assertion creates an immediate runtime panic that propagates through the application's execution flow, ultimately terminating the entire kuma-cp process. The panic occurs at the earliest stage of token processing, before any signature verification, claim validation, or authorization logic can execute, effectively preventing legitimate authentication attempts from completing.
The operational impact of this vulnerability extends beyond simple service disruption to encompass complete system unavailability. When the kuma-cp process terminates due to the panic, all dependent services fail simultaneously including the HTTP API endpoints, health and readiness probes, and the xDS (xDS protocol) communication channels that are essential for service mesh operation. The gRPC server responsible for dataplane communications becomes completely inaccessible, rendering the entire service mesh infrastructure non-functional until manual intervention restores the control plane. This represents a severe availability issue that can be exploited by malicious actors or inadvertently triggered by malformed client requests.
The vulnerability creates a particularly dangerous attack surface since it requires only unauthenticated access to trigger the crash mechanism through the dataplane gRPC server interface. An attacker could potentially sustain an outage by repeatedly sending malformed JWT tokens with numeric kid headers, causing the control plane to continuously restart and become unavailable for legitimate service operations. While a single request results in only transient interruption, sustained exploitation can maintain persistent denial of service conditions. This vulnerability aligns with CWE-470, which addresses "Use of Externally-Controlled Input to Select Code", and maps to ATT&CK technique T1499.004 for "Endpoint Denial of Service" as it specifically targets the control plane's endpoint availability.
Mitigation strategies should focus on implementing proper input validation and type checking within the JWT parsing logic, specifically ensuring that the kid header values are consistently validated as strings before any type assertions occur. The implementation should include explicit type checks and graceful error handling for malformed tokens rather than allowing runtime panics to propagate. Additionally, implementing circuit breaker patterns and request rate limiting can help prevent sustained exploitation attempts. The fix should also incorporate comprehensive logging of malformed token attempts to facilitate monitoring and incident response activities. Organizations should consider implementing automated recovery mechanisms or redundant control plane instances to minimize the impact of such vulnerabilities on service availability and maintain robust security posture against similar type assertion flaws in other components.