CVE-2026-18676

Awaiting Analysis Awaiting Analysis - Queue

Kong Mesh kuma-cp CORS Misconfiguration Exposes Admin Token

Publication date: 2026-08-12

Last updated on: 2026-10-23

Assigner: Kong

Description

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-10-23

Generated

2026-11-08

AI Q&A

2026-08-12

EPSS Evaluated

2026-11-07

NVD

CVE-2026-18676

EUVD

EUVD-2026-57423

Affected Vendors & Products

Vendor	Product	Version / Range
kumahq	kuma	2.7.25
kumahq	kuma	2.9.15
kumahq	kuma	2.11.13
kumahq	kuma	2.12.10
kumahq	kuma	2.13.5
kumahq	kuma	2.9
kumahq	kuma	2.11
kumahq	kuma	2.12
kumahq	kuma	2.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

CVE-2026-18676 is a vulnerability in Kong Mesh's kuma-cp control plane where the default configuration exposes the admin bootstrap token and signing keys to any webpage visited by the operator. This occurs due to a CORS misconfiguration that allows cross-origin fetch requests to retrieve sensitive admin credentials.

Detection Guidance

Check if kuma-cp is running on versions before 2.7.25, 2.9.0-2.9.14, 2.11.0-2.11.12, 2.12.0-2.12.9, or 2.13.0-2.13.4. Inspect CORS settings for CorsAllowedDomains set to [".*"] and LocalhostIsAdmin set to true. Use curl to test for exposed admin tokens: curl -H "Origin: http://malicious.site" http://localhost:5681/global-insights. If the response includes admin tokens, the system is vulnerable.

Verify network exposure by checking if kuma-cp binds to non-loopback interfaces (e.g., netstat -tuln | grep 5681). Ensure no port forwarding exposes the admin API to untrusted networks.

Impact Analysis

An attacker could trick the operator into visiting a malicious webpage with JavaScript that fetches the admin token via a cross-origin request. This could lead to unauthorized access to the control plane, allowing the attacker to manipulate the mesh network, intercept traffic, or escalate privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive admin tokens and signing keys, potentially exposing personal or health data. GDPR requires protecting personal data, and HIPAA mandates securing protected health information. A breach could result in non-compliance with these regulations due to unauthorized data exposure.

Mitigation Strategies

Upgrade kuma-cp to patched versions (2.7.25, 2.9.15, 2.11.13, 2.12.10, or 2.13.5+). Disable LocalhostIsAdmin by setting KUMA_API_SERVER_AUTHN_LOCALHOST_ISAdmin=false. Restrict CORS domains to explicit allowlists instead of [".*"].

Avoid running kuma-cp on machines used for browsing untrusted sites. If running in Docker, avoid host network mode. For Kubernetes, use ClusterIP/NodePort instead of port-forwarding to untrusted machines.

Hi! I’m here to help you understand CVE-2026-18676. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...