This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-18679 | BDVDB-2026-358289 Detail

KongKong Mesh

Description#

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.

Impact#

Control plane impersonation

Weaknesses#

  • CWE-295 Improper Certificate Validation

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.