{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-18678",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-18678",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-12T18:49:45.530Z",
    "updatedAt": "2026-08-13T14:47:36.551Z",
    "importedAt": "2026-10-24T01:57:55.771Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured",
      "summary": "When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.\n\n\n\nAn attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.",
      "affected": [
        {
          "vendor": "Kong Inc.",
          "product": "Kong Mesh",
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2.7.26"
            },
            {
              "version": "2.8.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2.9.16"
            },
            {
              "version": "2.10.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2.11.14"
            },
            {
              "version": "2.12.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2.12.11"
            },
            {
              "version": "2.13.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "2.13.7"
            }
          ]
        }
      ]
    }
  }
}