CVE-2026-18676: Kong Mesh 0 to before 2.7.25, 2.8.0 to before 2.9.15, 2.10.0 to before 2.11.13, 2.12.0 to before 2.12.10, 2.13.0 to…

Affected technology

Kong Mesh · 0 to before 2.7.25, 2.8.0 to before 2.9.15, 2.10.0 to before 2.11.13, 2.12.0 to before 2.12.10, 2.13.0 to before 2.13.5
Kong Inc.

Component: kuma-cp

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.