CVE-2026-18676

Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

State: Published
Severity: 5.1 Medium
Published: Aug 12, 2026
Updated: Aug 13, 2026
Reserved: Aug 3, 2026

Description

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	Kong

Weaknesses

CWE-346 Origin Validation Error
CWE-942 Permissive Cross-domain Policy with Untrusted Domain

Affected Products

Product	Versions
Kong MeshKong Inc.	before 2.7.25Affected 2.8.0 to before 2.9.15Affected 2.10.0 to before 2.11.13Affected 2.12.0 to before 2.12.10Affected 2.13.0 to before 2.13.5Affected

References

Upstream advisory GHSA-3vcp-chfh-f6r2vendor-advisory
kumahq/kuma#16416 (master)patch
kumahq/kuma#16423 (backport)patch
kumahq/kuma#16424 (backport)patch
kumahq/kuma#16425 (backport)patch
kumahq/kuma#16426 (backport)patch
kumahq/kuma#16427 (backport)patch
Kong MESH Changelogrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.