Vulnerability Description
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
Related Weaknesses (CWE)
References
- https://developer.konghq.com/mesh/changelog/
- https://github.com/kumahq/kuma/pull/16416
- https://github.com/kumahq/kuma/pull/16423
- https://github.com/kumahq/kuma/pull/16424
- https://github.com/kumahq/kuma/pull/16425
- https://github.com/kumahq/kuma/pull/16426
- https://github.com/kumahq/kuma/pull/16427
- https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2
FAQ
What is CVE-2026-18676?
CVE-2026-18676 is a documented vulnerability. The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a C...
How severe is CVE-2026-18676?
CVSS scoring is not yet available for CVE-2026-18676. Check NVD for updates.
Is there a patch for CVE-2026-18676?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.