vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-18676

Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

MEDIUM
5.1
CVSS Score
Published: August 12, 2026 at 06:42 PM UTC
Updated: October 23, 2026 at 07:10 PM UTC
1 product affected across 1 vendorKong Mesh

Using Kong Mesh by Kong Inc.?

Get instant alerts when new vulnerabilities affect Kong Mesh - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Kong Mesh· Kong
90%
0 ≤ v < 2.7.252.10.0 ≤ v < 2.11.132.12.0 ≤ v < 2.12.102.13.0 ≤ v < 2.13.52.8.0 ≤ v < 2.9.1502.10.02.12.02.13.02.8.0
Affected range stops below 2.11.13, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.12.10, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.13.5, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.7.25, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.9.15, so it looks safe — our inference, not a vendor statement

References (8)

Vendor Advisory
Source: cverecord
https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2
Patch
Source: cverecord
https://github.com/kumahq/kuma/pull/16416
Patch
Source: cverecord
https://github.com/kumahq/kuma/pull/16423
Patch
Source: cverecord
https://github.com/kumahq/kuma/pull/16424
Patch
Source: cverecord
https://github.com/kumahq/kuma/pull/16425
Patch
Source: cverecord
https://github.com/kumahq/kuma/pull/16426
Patch
Source: cverecord
https://github.com/kumahq/kuma/pull/16427
Vendor AdvisoryRelease Notes
Source: cverecord
https://developer.konghq.com/mesh/changelog/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.1MEDIUMKong
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-346CWE-942

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card