CVE-2026-18676

EUVD-2026-57423
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://developer.konghq.com/mesh/changelog/
https://github.com/kumahq/kuma/pull/16416
https://github.com/kumahq/kuma/pull/16423
https://github.com/kumahq/kuma/pull/16424
https://github.com/kumahq/kuma/pull/16425
https://github.com/kumahq/kuma/pull/16426
https://github.com/kumahq/kuma/pull/16427
https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2