EUVD-2026-57423
GHSA-x23j-4pcq-m26j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because three conditions must simultaneously hold; C:H/I:H because leaked admin JWT enables full mesh control-plane compromise.
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
Lifecycle Timeline
2DescriptionCVE.org
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
AnalysisAI
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visited by an operator while the control plane is browser-reachable, due to two compounding default misconfigurations. The default CORS wildcard (CorsAllowedDomains: [".*"]) reflects any attacker-controlled Origin header, and the default LocalhostIsAdmin: true promotes loopback-sourced browser requests to mesh-system:admin without credential validation - a cross-origin fetch() from an attacker page is sufficient to receive full administrative credentials. This affects kuma-cp versions prior to 2.7.25, 2.9.15, 2.11.13, and 2.12.10; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The root cause is CWE-346 (Origin Validation Error): kuma-cp's API server performs loopback-address authentication (LocalhostIsAdmin) based solely on the TCP RemoteAddr, without cross-referencing the HTTP Origin header or proxy-hop headers. When a browser on the same host issues a cross-origin fetch() to localhost:5681, the TCP connection legitimately originates from 127.0.0.1, satisfying the loopback check. The API server then elevates the request to mesh-system:admin and the CORS wildcard (CorsAllowedDomains: [".*"]) reflects the attacker's Origin back, making the response readable by the attacker's JavaScript. The affected package is go/github.com/kumahq/kuma (CPE: cpe:2.3:a:kong_inc.:kong_mesh:*:*:*:*:*:*:*:*). The fix tightens isDirectLoopbackRequest() to additionally validate that no proxy-hop headers (X-Forwarded-For, Forwarded, X-Real-IP), cross-site fetch metadata (Sec-Fetch-Site), or a non-localhost Origin are present, and changes the CORS default from a wildcard to an empty allowlist.
RemediationAI
The primary fix is upgrading kuma-cp to a patched release: 2.7.25, 2.9.15, 2.11.13, or 2.12.10 depending on the active release branch, per the GHSA advisory at https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2. Patched versions change CorsAllowedDomains default to empty (opt-in CORS) and harden LocalhostIsAdmin to reject requests bearing proxy-hop headers, cross-site fetch metadata, or a non-localhost Origin. If immediate upgrade is not possible, two environment-variable mitigations can be applied: set KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false (trade-off: initial kumactl bootstrap must switch to token-based auth via kumactl config control-planes add --auth-type=tokens) and set KUMA_API_SERVER_CORS_ALLOWED_DOMAINS to an explicit allowlist such as http://localhost:5681,http://127.0.0.1:5681 (trade-off: breaks any custom GUI on a different origin until explicitly listed). A third operational control - not running kuma-cp on a machine used for general web browsing - eliminates the attack surface without configuration changes but is operationally fragile. The fix PRs are https://github.com/kumahq/kuma/pull/16416 (primary) with backports in PRs 16423-16427.
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwr
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another w
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HT
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the en
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today