GHSA-x23j-4pcq-m26jMedium
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys...
🔗 CVE IDs covered (1)
📋 Description
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
🔗 References (10)
- https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2
- https://nvd.nist.gov/vuln/detail/CVE-2026-18676
- https://github.com/kumahq/kuma/pull/16416
- https://github.com/kumahq/kuma/pull/16423
- https://github.com/kumahq/kuma/pull/16424
- https://github.com/kumahq/kuma/pull/16425
- https://github.com/kumahq/kuma/pull/16426
- https://github.com/kumahq/kuma/pull/16427
- https://developer.konghq.com/mesh/changelog
- https://github.com/advisories/GHSA-x23j-4pcq-m26j