CVE-2026-18673 Kong Inc. CVE debrief

Who should care

Organizations using kuma-dp with Envoy admin API on Unix domain sockets, administrators of data plane networks, and security teams responsible for monitoring and protecting against unauthorized access.

Technical summary

The kuma-dp service, when configured with the Envoy admin API on a Unix domain socket, exposes a readiness service on TCP port 9902 bound to all interfaces without authentication. This allows an attacker with network access to port 9902 to read Envoy and data plane configuration, including config dumps, cluster and listener lists, stats, and the mesh trust bundle. The exposure is read-only, and destructive Envoy admin actions are blocked. Private keys are not exposed.

Defensive priority

Organizations using kuma-dp with Envoy admin API on Unix domain sockets should verify their configurations and restrict access to port 9902.

Recommended defensive actions

• Verify kuma-dp configurations to ensure Envoy admin API access is restricted to necessary services.
• Implement network controls to limit access to port 9902.
• Monitor for potential unauthorized access attempts on port 9902.
• Review and apply vendor patches or updates when available.
• Perform a thorough review of the data plane's network configuration to identify and restrict access to port 9902.
• Conduct regular security audits to ensure that all access to the Envoy admin API is properly authenticated and authorized.
• Establish a process for tracking and addressing exceptions related to access and configuration changes.

Evidence notes

The CVE description indicates that an attacker with network access to port 9902 can read Envoy and data plane configuration without credentials. Exposure is read-only, and destructive Envoy admin actions are blocked. Private keys are not exposed. Further analysis is needed to determine the full scope of affected systems and vendor remediation efforts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.