VULNERABILITY INTELLIGENCE

CVE-2026-18675

EPSS probability0.56%
CISA KEVNot currently listed
Published2026-08-12
Last modified2026-10-23

Description

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.

Weakness classification

  • 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb: CWE-248

Primary references