{"id":"CVE-2026-18676","aliases":["EUVD-2026-57423","GHSA-3vcp-chfh-f6r2","GHSA-x23j-4pcq-m26j","GO-2026-5102"],"status":"published","title":"Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin","description":"The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00298,"percentile":0.22648,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-346","CWE-942"],"published":"2026-05-14T20:15:08Z","modified":"2026-10-28T02:31:13Z","affected":[{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.25"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"2.9.0"},{"fixed":"2.9.15"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"2.11.0"},{"fixed":"2.11.13"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"2.12.0"},{"fixed":"2.12.10"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"2.13.0"},{"fixed":"2.13.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.25"},{"introduced":"2.9.13"},{"fixed":"2.11.13"},{"introduced":"2.12.4"},{"fixed":"2.12.10"},{"introduced":"2.13.0"},{"fixed":"2.13.5"}]}],"bundled":2}],"products":[{"vendor":"kong inc.","product":"kong mesh"}],"references":[{"url":"https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2","tags":["vendor-advisory","advisory","web"]},{"url":"https://github.com/kumahq/kuma/pull/16416","tags":["patch","fix","web"]},{"url":"https://github.com/kumahq/kuma/pull/16423","tags":["patch","fix","web"]},{"url":"https://github.com/kumahq/kuma/pull/16424","tags":["patch","fix","web"]},{"url":"https://github.com/kumahq/kuma/pull/16425","tags":["patch","fix","web"]},{"url":"https://github.com/kumahq/kuma/pull/16426","tags":["patch","fix","web"]},{"url":"https://github.com/kumahq/kuma/pull/16427","tags":["patch","fix","web"]},{"url":"https://developer.konghq.com/mesh/changelog/","tags":["release-notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18676","tags":["advisory"]},{"url":"https://developer.konghq.com/mesh/changelog"},{"url":"https://github.com/advisories/GHSA-x23j-4pcq-m26j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18676.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45021.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45021","tags":["advisory"]},{"url":"https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907","tags":["fix","web"]},{"url":"https://github.com/kumahq/kuma","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-18676","title":"Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin","description":"The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.","status":"published","published":"2026-08-12T18:42:38.843Z","modified":"2026-08-13T14:50:43.069Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-57423","description":"The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.","status":"published","published":"2026-08-12T18:42:38Z","modified":"2026-08-13T14:50:43Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:56.415282Z"}],"ghsa":[{"id":"GHSA-x23j-4pcq-m26j","title":"The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys...","description":"The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.","status":"published","published":"2026-08-12T21:31:37Z","modified":"2026-08-12T21:31:44Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:10:23.958572Z"}],"nvd":[{"id":"CVE-2026-18676","description":"The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.","status":"published","published":"2026-08-12T19:17:30.813Z","modified":"2026-10-23T19:10:00.167Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-18676","title":"Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin","description":"The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.","status":"published","published":"2026-08-12T18:42:38.843Z","modified":"2026-10-28T02:30:57.394180555Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"CVE-2026-45021","title":"Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin","description":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.","status":"published","published":"2026-05-28T17:45:14.434Z","modified":"2026-10-28T02:31:13.464626116Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"GHSA-3vcp-chfh-f6r2","title":"Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin","description":"## Summary\n\nDefault `kuma-cp` config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. `CorsAllowedDomains: [\".*\"]` reflects any `Origin`, and `LocalhostIsAdmin: true` promotes requests from `127.0.0.1` to `mesh-system:admin`. A cross-origin `fetch()` from a malicious page returns the admin JWT and signing material.\n\n## Am I affected?\n\nYou are affected if all of these hold:\n\n1. `kuma-cp` runs with default config (`CorsAllowedDomains: [\".*\"]` and `LocalhostIsAdmin: true`).\n2. The control plane is reachable from a browser on the same machine:\n   - `kuma-cp run` on a developer laptop\n   - Docker `--network host` or port-publish on a workstation\n   - `kubectl port-forward` from a machine that also browses the web\n3. The operator visits a page running attacker JavaScript while the control plane is reachable.\n\nYou are not affected if:\n\n- The control plane runs on a Kubernetes cluster accessed via ClusterIP, NodePort, or LoadBalancer from a remote client.\n- The control plane runs on an SSH-administered VM with no browser on the host.\n- `KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false` is set (see https://kuma.io/docs/latest/production/secure-deployment/api-server-auth/).\n- `KUMA_API_SERVER_CORS_ALLOWED_DOMAINS` is set to an explicit allowlist that excludes attacker origins.\n\n## Mitigation\n\n1. Set `KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false` after retrieving the admin token.\n2. Set `KUMA_API_SERVER_CORS_ALLOWED_DOMAINS` to an explicit allowlist, for example `http://localhost:5681,http://127.0.0.1:5681`.\n3. Do not run `kuma-cp` on a machine where you browse untrusted sites.\n\n## Fix\n\nFixed in [#16416](https://github.com/kumahq/kuma/pull/16416), backported to all supported release branches ([#16423](https://github.com/kumahq/kuma/pull/16423), [#16424](https://github.com/kumahq/kuma/pull/16424), [#16425](https://github.com/kumahq/kuma/pull/16425), [#16426](https://github.com/kumahq/kuma/pull/16426), [#16427](https://github.com/kumahq/kuma/pull/16427)).\n\nChanges in patched versions:\n\n- `CorsAllowedDomains` default changed from `[\".*\"]` to `[]` — CORS is now opt-in; set the env var explicitly if you need GUI access.\n- `LocalhostIsAdmin` hardened: now requires direct loopback `RemoteAddr` and `Host`, and rejects requests carrying proxy-hop headers (`X-Forwarded-For`), cross-site fetch metadata (`Sec-Fetch-Site`), or a non-localhost `Origin`.\n\nUpgrade to a patched version:\n\n- 2.7.25\n- 2.9.15\n- 2.11.13\n- 2.12.10\n- 2.13.5\n\n## Credits\n\nReported by `eldudareeno`.\n\n## CVSS\n\n`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N` = 5.1 Medium.","status":"published","published":"2026-05-14T20:15:08Z","modified":"2026-09-10T03:50:45.346790306Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-346","CWE-942"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"GO-2026-5102","title":"Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma","description":"Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/kumahq/kuma/v2 from v2.9.0 before v2.9.15.","status":"published","published":"2026-07-22T20:36:55Z","modified":"2026-08-13T04:10:36.471482007Z","updated_at":"2026-11-02T15:47:02.280725Z"}]}}