EUVD-2026-32966
GHSA-3vcp-chfh-f6r2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Summary
Default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material.
Am I affected?
You are affected if all of these hold:
kuma-cpruns with default config (CorsAllowedDomains: [".*"]andLocalhostIsAdmin: true).- The control plane is reachable from a browser on the same machine:
kuma-cp runon a developer laptop- Docker
--network hostor port-publish on a workstation kubectl port-forwardfrom a machine that also browses the web
- The operator visits a page running attacker JavaScript while the control plane is reachable.
You are not affected if:
- The control plane runs on a Kubernetes cluster accessed via ClusterIP, NodePort, or LoadBalancer from a remote client.
- The control plane runs on an SSH-administered VM with no browser on the host.
KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=falseis set (see https://kuma.io/docs/latest/production/secure-deployment/api-server-auth/).KUMA_API_SERVER_CORS_ALLOWED_DOMAINSis set to an explicit allowlist that excludes attacker origins.
Mitigation
- Set
KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=falseafter retrieving the admin token. - Set
KUMA_API_SERVER_CORS_ALLOWED_DOMAINSto an explicit allowlist, for examplehttp://localhost:5681,http://127.0.0.1:5681. - Do not run
kuma-cpon a machine where you browse untrusted sites.
Fix
Fixed in #16416, backported to all supported release branches (#16423, #16424, #16425, #16426, #16427).
Changes in patched versions:
CorsAllowedDomainsdefault changed from[".*"]to[]- CORS is now opt-in; set the env var explicitly if you need GUI access.LocalhostIsAdminhardened: now requires direct loopbackRemoteAddrandHost, and rejects requests carrying proxy-hop headers (X-Forwarded-For), cross-site fetch metadata (Sec-Fetch-Site), or a non-localhostOrigin.
Upgrade to a patched version:
- 2.7.25
- 2.9.15
- 2.11.13
- 2.12.10
- 2.13.5
Credits
Reported by eldudareeno.
CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N = 5.1 Medium.
AnalysisAI
Kuma Control Plane with default configuration leaks admin bootstrap tokens and signing keys to any website an operator visits if the control plane is reachable from their browser. The vulnerability combines default CORS settings allowing all origins (CorsAllowedDomains: [".*"]) with LocalhostIsAdmin: true, which grants admin privileges to any request from 127.0.0.1 without validating whether it originates from a trusted same-origin context. An attacker's JavaScript on a visited webpage can cross-origin fetch the admin token and cryptographic material via browser requests to localhost:5681. This is not actively exploited in the wild but represents a realistic threat in developer and testing environments where control planes run on workstations with web browsers.
Technical ContextAI
Kuma is a Kubernetes-native service mesh control plane written in Go. The vulnerability stems from overly permissive defaults in the API server's CORS (Cross-Origin Resource Sharing) and authentication layers. The CORS configuration CorsAllowedDomains: [".*"] matches any Origin header via regex, causing the API server to reflect wildcard CORS headers in responses, bypassing browser Same-Origin Policy protections. Simultaneously, the LocalhostIsAdmin authenticator in pkg/api-server/authn/localhost.go originally granted admin privileges to any HTTP request with RemoteAddr of 127.0.0.1 or ::1, without validating whether the request originated from a trusted localhost webpage or was injected by cross-origin JavaScript. When a browser on the same machine (e.g., developer laptop, Docker host with --network host, or kubectl port-forward session) visits an attacker-controlled page, that page's JavaScript can use fetch() to reach the locally-exposed API server. The combination of CORS bypass and localhost-source-based privilege escalation allows credential theft without any user action beyond visiting a malicious site. The root cause is CWE-346 (Origin Validation Error) - the application fails to validate request origins before granting admin access.
RemediationAI
Immediately upgrade Kuma Control Plane to a patched version: 2.7.25, 2.9.15, 2.11.13, 2.12.10, or 2.13.5+. Consult GitHub advisory https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2 for release notes. If upgrade is not immediately possible, apply compensating controls: Set environment variable KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false after retrieving the initial admin bootstrap token via direct loopback or out-of-band mechanism; this removes the automatic localhost privilege escalation. Additionally, set KUMA_API_SERVER_CORS_ALLOWED_DOMAINS to an explicit allowlist (e.g., http://localhost:5681,http://127.0.0.1:5681 for local GUI access) or empty list if CORS is not needed; do not rely on regex patterns. As a third control, administratively restrict control-plane network access to exclude web-browsing hosts - run kuma-cp on dedicated management VMs or SSH-administered systems where no web browser is installed, rather than on developer workstations. These mitigations carry trade-offs: disabling LocalhostIsAdmin requires token-based authentication via kumactl for initial setup; explicit CORS allowlisting requires knowledge of all GUI origins and breaks dynamic reverse-proxy deployments; and host isolation reduces operational convenience for local testing.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today