Log in Start free

Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-45021Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Medium 5.1

In plain English

A medium-severity security flaw in kuma from kumahq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.3%top 79.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/kumahq/kuma2.7.25GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kuma2.9.15GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kuma2.11.13GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kuma2.12.10GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kuma2.13.5GHSA-3vcp-chfh-f6r2
Gogithub.com/kumahq/kumano fix listedGO-2026-5102
Gogithub.com/kumahq/kuma/v22.11.13, 2.12.10, 2.13.5, 2.7.25GO-2026-5102

Affected products (as reported)

VendorProductVersions
kumahq kuma < 2.7.25>= 2.9.0, < 2.9.15>= 2.11.0, < 2.11.13>= 2.12.0, < 2.12.10>= 2.13.0, < 2.13.5

Weakness: CWE-346, CWE-942 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References