kuma-dp: readiness port 9902 proxies the Envoy admin API to the pod network with no authentication

Impact

With the Envoy admin API on a Unix socket - the default - kuma-dp's readiness service on TCP 9902 binds all interfaces and forwards nearly the whole admin API to any caller that reaches it, unauthenticated. That yields config dumps, cluster and listener inventories, stats, and the mesh trust bundle for every data plane in the mesh. In a GPU cluster where the service mesh fronts inference endpoints and model-registry traffic, this hands a co-tenant pod a full map of internal services, their routing, and the mesh's trust anchors - useful reconnaissance for lateral movement even though the exposure is read-only. Destructive Envoy admin actions are blocked and private keys are not exposed.

Who can reach it

Any workload with network reach to a data plane pod's port 9902 - in practice any other pod on the cluster network, since NetworkPolicy rarely covers this port. No credentials required.

What to do

Upgrade Kong Mesh / Kuma to a release carrying the fixes in kumahq/kuma PRs 17317 and 17418 and roll the data planes so every kuma-dp sidecar restarts; the control plane alone is not enough. As an immediate mitigation, apply a NetworkPolicy restricting inbound 9902 to the kubelet or the health-check source, or bind the readiness service to localhost where your deployment allows it.

References

Related entries

• containerd: Crafted image causes DoS during container creationCVE-2026-47262 · containerdMedium
• Flux source-controller (Bucket artifact write path, GitRepository sparse-checkout): An actor who can influence theCVE-2026-47680 · Flux source-controller (Bucket artifact write path, GitRepository sparse-checkout)Medium
• Envoy Gateway: unsynchronized Wasm cache map read/write crashes the controller processCVE-2026-53715 · Envoy Gateway controller (internal/wasm HTTP server, port 18002)Medium
• Podman: Malicious image WORKDIR symlink creates directories or changes ownership on the host filesystemCVE-2026-55686 · PodmanMedium
• BuildKit: invalid SecurityMode disables Seccomp and AppArmor without the insecure entitlementCVE-2026-61711 · BuildKit executor/oci/spec_linux.go (SecurityMode validation)Medium
• Traefik Gateway API provider: extensionRef resolved in the wrong namespace, letting a route bind an ungranted MiddlewareCVE-2026-65601 · Traefik Kubernetes Gateway API provider (HTTPRoute extensionRef namespace resolution)Medium