Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-18677 SPIFFE Identity Spoofing in Kong Mesh Universal Mode https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-18677
Post summary
The text briefly mentions CVE-2026-18677, describing it as SPIFFE Identity Spoofing in Kong Mesh Universal Mode, and provides a link to a vulnerability details page, but offers no deeper technical, exploit, or remediation information.