CVE-2026-18676 | BDVDB-2026-358286 Detail
KongKong Mesh
Description#
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
Impact#
Credential disclosure
Weaknesses#
References#
- https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2
- https://github.com/kumahq/kuma/pull/16416
- https://github.com/kumahq/kuma/pull/16423
- https://github.com/kumahq/kuma/pull/16424
- https://github.com/kumahq/kuma/pull/16425
- https://github.com/kumahq/kuma/pull/16426
- https://github.com/kumahq/kuma/pull/16427
- https://developer.konghq.com/mesh/changelog/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.