CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthorized access to the Envoy admin API through the readiness service on TCP port 9902, which is exposed on all interfaces by default. Attackers with network access can retrieve sensitive configuration data, including stats and cluster information, without authentication, although they cannot perform destructive actions or access private keys. Organizations using kuma-dp with the Envoy admin API should prioritize addressing this issue to mitigate potential information leakage risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.