CVE-2026-18674

This is a trust model vulnerability masquerading as an authentication bypass. The in-band ControlPlane.Identifier that zones self-report to the global control plane should be treated as untrusted user input—it is not verified against the authenticated mTLS connection identity, which means a compromised zone can attribute its resources to any other zone in the mesh. The CVSS 7 score badly underestimates the real risk. One compromised credential does not just affect that zone—it poisons the global control plane's state store, which then propagates false resource attributions to every enrolled peer. Your southbound routing, policy enforcement, and observability data could all be polluted from a single initial breach. The scope is not one zone impersonating another—it is every zone's resource namespace becoming untrusted and potentially mutable by any enrolled peer. A critical distinction determines whether you are actually protected: the upstream Kuma fix either validates the identifier against connection identity (a validation-layer fix) or eliminates identifier trust entirely (a trust model restructuring). These produce wildly different long-term outcomes. Validation fixes have a documented track record of recurrence because they treat the symptom rather than the architectural assumption that identifiers can ever be trusted claims. If Kong Mesh backported only the former, you have bought a whack-a-mole security posture. Worse, patching the global control plane does not close the vulnerability in heterogeneous deployments—it changes its mode of failure. The exposure window only closes when the last zone re-syncs clean state. If zones update weekly under normal change management, you have added compounding multiplicative risk during that window. The CVSS score is a snapshot. This vulnerability is a rolling exposure window. Check your Kong Mesh version's backport notes. Confirm whether the fix validates identifiers or restructures the trust model. Assume the contamination half-life extends through your slowest-updating zone.

Reviewed through automated stages and approved by a human before publication.