Log in Start free

Vulnerability · Published Aug 12, 2026 · Assigned by Kong

CVE-2026-18676Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

Medium 5.1

In plain English

A medium-severity security flaw in Kong Mesh from Kong Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.3%top 77.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/kumahq/kuma2.7.25GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kuma2.9.15GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kuma2.11.13GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kuma2.12.10GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kuma2.13.5GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kumano fix listedGO-2026-5102
Gogithub.com/kumahq/kuma/v22.11.13, 2.12.10, 2.13.5, 2.7.25GO-2026-5102

Affected products (as reported)

VendorProductVersions
Kong Inc. Kong Mesh 0 – before 2.7.252.8.0 – before 2.9.152.10.0 – before 2.11.132.12.0 – before 2.12.102.13.0 – before 2.13.5

Weakness: CWE-346, CWE-942 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References