CVE-2026-18675

Published: Ago 12, 2026 Last Modified: Ago 12, 2026

ExploitDB:

Other exploit source:

Google Dorks:

MEDIUM 5,3

Source: 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb

Attack Vector: adjacent

Attack Complexity: low

Privileges Required: none

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

Description

AI Translation Available

The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.

The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS. Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token

A single request is a transient interruption; sustaining an outage requires repeated requests.