Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-18676

Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Kong

Description

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kong Inc. Kong Mesh

Default version status: unaffected

  • 0 to < 2.7.25affected
  • 2.8.0 to < 2.9.15affected
  • 2.10.0 to < 2.11.13affected
  • 2.12.0 to < 2.12.10affected
  • 2.13.0 to < 2.13.5affected

References