EUVD-2026-322626

fkie_cve-2026-45021

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.

GHSA-3vcp-chfh-f6r2 — Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Affected: Go: github.com/kumahq/kuma

## Summary

Default `kuma-cp` config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. `CorsAllowedDomains: [".*"]` reflects any `Origin`, and `LocalhostIsAdmin: true` promotes requests from `127.0.0.1` to `mesh-system:admin`. A cross-origin `fetch()` from a malicious page returns the admin JWT and signing material.

## Am I affected?

You are affected if all of these hold:

1. `kuma-cp` runs with default config (`CorsAllowedDomains: [".*"]` and `LocalhostIsAdmin: true`). 2. The control plane is reachable from a browser on the same machine: - `kuma-cp run` on a developer laptop - Docker `--network host` or port-publish on a workstation - `kubectl port-forward` from a machine that also browses the web 3. The operator visits a page running attacker JavaScript while the control plane is reachable.

You are not affected if:

- The control plane runs on a Kubernetes cluster accessed via ClusterIP, NodePort, or LoadBalancer from a remote client. - The control plane runs on an SSH-administered VM with no browser on the host. - `KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false` is set (see https://kuma.io/docs/latest/production/secure-deployment/api-server-auth/). - `KUMA_API_SERVER_CORS_ALLOWED_DOMAINS` is set to an explicit allowlist that excludes attacker origins.

## Mitigation

1. Set `KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false` after retrieving the admin token. 2. Set `KUMA_AP…

Most recent entries from all

EUVD-2026-322626

fkie_cve-2026-45021

GHSA-3vcp-chfh-f6r2 — Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin