The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs. The panic terminates the entire kuma-cp process, HTTP API, the health and readiness endpoints, and xDS.
Unauthenticated access to the dataplane gRPC server can trigger the crash with a malformed token A single request is a transient interruption; sustaining an outage requires repeated requests.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 9
https://developer.konghq.com/mesh/changelog/
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17465
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17467
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17468
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17469
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17470
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17471
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/pull/17472
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
https://github.com/kumahq/kuma/security/advisories/GHSA-5mxq-7xq4-3vx8
02762ae7-200e-4b20-9b2b-a77d5b8fc4cb