Denial of Service Vulnerability in Kuma by Kong

CVE-2026-18675

What is CVE-2026-18675?

The token validator in Kuma's dataplane executes an unchecked Go type assertion on the JWT kid header. If a token's kid is represented as a JSON number, it decodes as a float64, resulting in a runtime panic before any signature verification or authorization checks take place. This leads to the termination of the entire Kuma process, affecting the HTTP API, health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can exploit this flaw by sending a malformed token. While a single request causes a transient outage, sustaining the crash requires multiple repeated requests.

References