CVE-2026-18676CWE-346CWE-942

CVE-2026-18676

published August 12, 2026

CVSS
5.1
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00298 · 21.3th percentile
Weaknesses
CWE-346 · Origin Validation Error; CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
Published
2026-08-12T23:17Z
References (8)
https://developer.konghq.com/mesh/changelog/ · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/16416 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/16423 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/16424 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/16425 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/16426 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/16427 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
EPSS history
Timeline
  • 12 AUG 18:42Z
    Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin
    cvelistv5