Kong Mesh kuma-cp CORS Misconfiguration Exposes Admin Token

Executive Summary

CVE-2026-18676 is a vulnerability in Kong Mesh's kuma-cp control plane where the default configuration exposes the admin bootstrap token and signing keys to any webpage visited by the operator. This occurs due to a CORS misconfiguration that allows cross-origin fetch requests to retrieve sensitive admin credentials.

Useful 0 Not Useful 0

Detection Guidance

Check if kuma-cp is running on versions before 2.7.25, 2.9.0-2.9.14, 2.11.0-2.11.12, 2.12.0-2.12.9, or 2.13.0-2.13.4. Inspect CORS settings for CorsAllowedDomains set to [".*"] and LocalhostIsAdmin set to true. Use curl to test for exposed admin tokens: curl -H "Origin: http://malicious.site" http://localhost:5681/global-insights. If the response includes admin tokens, the system is vulnerable.

Verify network exposure by checking if kuma-cp binds to non-loopback interfaces (e.g., netstat -tuln | grep 5681). Ensure no port forwarding exposes the admin API to untrusted networks.

Useful 0 Not Useful 0

Impact Analysis

An attacker could trick the operator into visiting a malicious webpage with JavaScript that fetches the admin token via a cross-origin request. This could lead to unauthorized access to the control plane, allowing the attacker to manipulate the mesh network, intercept traffic, or escalate privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade kuma-cp to patched versions (2.7.25, 2.9.15, 2.11.13, 2.12.10, or 2.13.5+). Disable LocalhostIsAdmin by setting KUMA_API_SERVER_AUTHN_LOCALHOST_ISAdmin=false. Restrict CORS domains to explicit allowlists instead of [".*"].

Avoid running kuma-cp on machines used for browsing untrusted sites. If running in Docker, avoid host network mode. For Kubernetes, use ClusterIP/NodePort instead of port-forwarding to untrusted machines.

Useful 0 Not Useful 0