https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 20:57:36 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-18677 <p>In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane&#39;s kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload&#39;s SPIFFE identity.</p> <p>In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane&#39;s kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload&#39;s SPIFFE identity.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-18677 https://vulnerability.circl.lu/vuln/ghsa-6p7w-xxw9-j47f <p>In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane&#39;s kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload&#39;s SPIFFE identity.</p> <p>In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane&#39;s kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload&#39;s SPIFFE identity.</p> https://vulnerability.circl.lu/vuln/ghsa-6p7w-xxw9-j47f