On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone. The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide.
The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 9
https://developer.konghq.com/mesh/changelog/
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17456
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17458
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17459
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17460
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17461
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17462
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17463
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/security/advisories/GHSA-m58j-fjmc-h3g4
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb