VULNERABILITY INTELLIGENCE
CVE-2026-18676
EPSS probability0.30%
CISA KEVNot currently listed
Published2026-08-12
Last modified2026-10-23
Description
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
Weakness classification
- 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb: CWE-346