Vulnerability-Lookup

CVE-2026-45021 (GCVE-0-2026-45021)

Vulnerability from cvelistv5 – Published: 2026-05-28 17:45 – Updated: 2026-05-28 19:30

Title

Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Summary

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 19:30 UTC

CWE

CWE-346 - Origin Validation Error
CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

8 references

URL	Tags
https://github.com/kumahq/kuma/security/advisorie…	x_refsource_CONFIRM
https://github.com/kumahq/kuma/pull/16416	x_refsource_MISC
https://github.com/kumahq/kuma/pull/16423	x_refsource_MISC
https://github.com/kumahq/kuma/pull/16424	x_refsource_MISC
https://github.com/kumahq/kuma/pull/16425	x_refsource_MISC
https://github.com/kumahq/kuma/pull/16426	x_refsource_MISC
https://github.com/kumahq/kuma/pull/16427	x_refsource_MISC
https://github.com/kumahq/kuma/commit/8fefa8595d4…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
kumahq	kuma	Affected: < 2.7.25 Affected: >= 2.9.0, < 2.9.15 Affected: >= 2.11.0, < 2.11.13 Affected: >= 2.12.0, < 2.12.10 Affected: >= 2.13.0, < 2.13.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45021",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T19:30:17.834875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T19:30:33.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kuma",
          "vendor": "kumahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.7.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.9.0, \u003c 2.9.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.11.0, \u003c 2.11.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.12.0, \u003c 2.12.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.13.0, \u003c 2.13.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T17:45:14.434Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16416",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16416"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16423",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16423"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16424",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16424"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16425",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16425"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16426",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16426"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16427",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16427"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907"
        }
      ],
      "source": {
        "advisory": "GHSA-3vcp-chfh-f6r2",
        "discovery": "UNKNOWN"
      },
      "title": "Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45021",
    "datePublished": "2026-05-28T17:45:14.434Z",
    "dateReserved": "2026-05-08T16:58:28.896Z",
    "dateUpdated": "2026-05-28T19:30:33.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45021",
      "date": "2026-11-14",
      "epss": "0.00276",
      "percentile": "0.2026"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "kuma",
                "vendor": "kumahq",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.7.25"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.9.0, \u003c 2.9.15"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.11.0, \u003c 2.11.13"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.12.0, \u003c 2.12.10"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.13.0, \u003c 2.13.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5."
          },
          {
            "lang": "es",
            "value": "Kuma es una malla de servicios moderna basada en Envoy que puede ejecutarse en cualquier nube tanto en Kubernetes como en VMs. Antes de 2.7.25, 2.9.15, 2.11.13, 2.12.10 y 2.13.5, la configuraci\u00f3n predeterminada de kuma-cp filtra el token de arranque de administrador y las claves de firma a cualquier p\u00e1gina web que el operador visite mientras el plano de control es accesible desde su navegador. CorsAllowedDomains: [\u2019.*\u2019] refleja cualquier Origen, y LocalhostIsAdmin: true promueve las solicitudes de 127.0.0.1 a mesh-system:admin. Una llamada fetch() de origen cruzado desde una p\u00e1gina maliciosa devuelve el JWT de administrador y el material de firma. Esta vulnerabilidad est\u00e1 corregida en 2.7.25, 2.9.15, 2.11.13, 2.12.10 y 2.13.5."
          }
        ],
        "id": "CVE-2026-45021",
        "lastModified": "2026-10-25T23:10:00.167",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-45021",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T19:30:17.834875Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-28T18:16:34.167",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kumahq/kuma/pull/16416"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kumahq/kuma/pull/16423"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kumahq/kuma/pull/16424"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kumahq/kuma/pull/16425"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kumahq/kuma/pull/16426"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kumahq/kuma/pull/16427"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-346"
              },
              {
                "lang": "en",
                "value": "CWE-942"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:32:56+00:00",
      "cve": "CVE-2026-45021",
      "id": "CVE-2026-45021",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45021.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-45021",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-28T19:30:17.834875Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-28T19:30:23.444Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "kuma",
              "vendor": "kumahq",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.7.25"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.9.0, \u003c 2.9.15"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.11.0, \u003c 2.11.13"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.12.0, \u003c 2.12.10"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.13.0, \u003c 2.13.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-346",
                  "description": "CWE-346: Origin Validation Error",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-942",
                  "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-28T17:45:14.434Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2"
            },
            {
              "name": "https://github.com/kumahq/kuma/pull/16416",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kumahq/kuma/pull/16416"
            },
            {
              "name": "https://github.com/kumahq/kuma/pull/16423",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kumahq/kuma/pull/16423"
            },
            {
              "name": "https://github.com/kumahq/kuma/pull/16424",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kumahq/kuma/pull/16424"
            },
            {
              "name": "https://github.com/kumahq/kuma/pull/16425",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kumahq/kuma/pull/16425"
            },
            {
              "name": "https://github.com/kumahq/kuma/pull/16426",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kumahq/kuma/pull/16426"
            },
            {
              "name": "https://github.com/kumahq/kuma/pull/16427",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kumahq/kuma/pull/16427"
            },
            {
              "name": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907"
            }
          ],
          "source": {
            "advisory": "GHSA-3vcp-chfh-f6r2",
            "discovery": "UNKNOWN"
          },
          "title": "Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-45021",
        "datePublished": "2026-05-28T17:45:14.434Z",
        "dateReserved": "2026-05-08T16:58:28.896Z",
        "dateUpdated": "2026-05-28T19:30:33.327Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45021

Vulnerability from fkie_nvd - Published: 2026-05-28 18:16 - Updated: 2026-10-25 23:10

Severity

5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907
	security-advisories@github.com	https://github.com/kumahq/kuma/pull/16416
	security-advisories@github.com	https://github.com/kumahq/kuma/pull/16423
	security-advisories@github.com	https://github.com/kumahq/kuma/pull/16424
	security-advisories@github.com	https://github.com/kumahq/kuma/pull/16425
	security-advisories@github.com	https://github.com/kumahq/kuma/pull/16426
	security-advisories@github.com	https://github.com/kumahq/kuma/pull/16427
	security-advisories@github.com	https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kuma",
          "vendor": "kumahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.7.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.9.0, \u003c 2.9.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.11.0, \u003c 2.11.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.12.0, \u003c 2.12.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.13.0, \u003c 2.13.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5."
    },
    {
      "lang": "es",
      "value": "Kuma es una malla de servicios moderna basada en Envoy que puede ejecutarse en cualquier nube tanto en Kubernetes como en VMs. Antes de 2.7.25, 2.9.15, 2.11.13, 2.12.10 y 2.13.5, la configuraci\u00f3n predeterminada de kuma-cp filtra el token de arranque de administrador y las claves de firma a cualquier p\u00e1gina web que el operador visite mientras el plano de control es accesible desde su navegador. CorsAllowedDomains: [\u2019.*\u2019] refleja cualquier Origen, y LocalhostIsAdmin: true promueve las solicitudes de 127.0.0.1 a mesh-system:admin. Una llamada fetch() de origen cruzado desde una p\u00e1gina maliciosa devuelve el JWT de administrador y el material de firma. Esta vulnerabilidad est\u00e1 corregida en 2.7.25, 2.9.15, 2.11.13, 2.12.10 y 2.13.5."
    }
  ],
  "id": "CVE-2026-45021",
  "lastModified": "2026-10-25T23:10:00.167",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45021",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-28T19:30:17.834875Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-28T18:16:34.167",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kumahq/kuma/pull/16416"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kumahq/kuma/pull/16423"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kumahq/kuma/pull/16424"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kumahq/kuma/pull/16425"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kumahq/kuma/pull/16426"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kumahq/kuma/pull/16427"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3VCP-CHFH-F6R2

Vulnerability from github – Published: 2026-05-14 20:15 – Updated: 2026-06-09 10:19

Summary

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Details

Summary

Default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material.

Am I affected?

You are affected if all of these hold:

kuma-cp runs with default config (CorsAllowedDomains: [".*"] and LocalhostIsAdmin: true).
The control plane is reachable from a browser on the same machine:
kuma-cp run on a developer laptop
Docker --network host or port-publish on a workstation
kubectl port-forward from a machine that also browses the web
The operator visits a page running attacker JavaScript while the control plane is reachable.

You are not affected if:

The control plane runs on a Kubernetes cluster accessed via ClusterIP, NodePort, or LoadBalancer from a remote client.
The control plane runs on an SSH-administered VM with no browser on the host.
KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false is set (see https://kuma.io/docs/latest/production/secure-deployment/api-server-auth/).
KUMA_API_SERVER_CORS_ALLOWED_DOMAINS is set to an explicit allowlist that excludes attacker origins.

Mitigation

Set KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false after retrieving the admin token.
Set KUMA_API_SERVER_CORS_ALLOWED_DOMAINS to an explicit allowlist, for example http://localhost:5681,http://127.0.0.1:5681.
Do not run kuma-cp on a machine where you browse untrusted sites.

Fix

Fixed in #16416, backported to all supported release branches (#16423, #16424, #16425, #16426, #16427).

Changes in patched versions:

CorsAllowedDomains default changed from [".*"] to [] — CORS is now opt-in; set the env var explicitly if you need GUI access.
LocalhostIsAdmin hardened: now requires direct loopback RemoteAddr and Host, and rejects requests carrying proxy-hop headers (X-Forwarded-For), cross-site fetch metadata (Sec-Fetch-Site), or a non-localhost Origin.

Upgrade to a patched version:

2.7.25
2.9.15
2.11.13
2.12.10
2.13.5

Credits

Reported by eldudareeno.

CVSS

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N = 5.1 Medium.

Severity

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kumahq/kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.7.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kumahq/kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.9.0"
            },
            {
              "fixed": "2.9.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kumahq/kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.11.0"
            },
            {
              "fixed": "2.11.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kumahq/kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.12.0"
            },
            {
              "fixed": "2.12.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kumahq/kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.13.0"
            },
            {
              "fixed": "2.13.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45021"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:15:08Z",
    "nvd_published_at": "2026-05-28T18:16:34Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nDefault `kuma-cp` config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. `CorsAllowedDomains: [\".*\"]` reflects any `Origin`, and `LocalhostIsAdmin: true` promotes requests from `127.0.0.1` to `mesh-system:admin`. A cross-origin `fetch()` from a malicious page returns the admin JWT and signing material.\n\n## Am I affected?\n\nYou are affected if all of these hold:\n\n1. `kuma-cp` runs with default config (`CorsAllowedDomains: [\".*\"]` and `LocalhostIsAdmin: true`).\n2. The control plane is reachable from a browser on the same machine:\n   - `kuma-cp run` on a developer laptop\n   - Docker `--network host` or port-publish on a workstation\n   - `kubectl port-forward` from a machine that also browses the web\n3. The operator visits a page running attacker JavaScript while the control plane is reachable.\n\nYou are not affected if:\n\n- The control plane runs on a Kubernetes cluster accessed via ClusterIP, NodePort, or LoadBalancer from a remote client.\n- The control plane runs on an SSH-administered VM with no browser on the host.\n- `KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false` is set (see https://kuma.io/docs/latest/production/secure-deployment/api-server-auth/).\n- `KUMA_API_SERVER_CORS_ALLOWED_DOMAINS` is set to an explicit allowlist that excludes attacker origins.\n\n## Mitigation\n\n1. Set `KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false` after retrieving the admin token.\n2. Set `KUMA_API_SERVER_CORS_ALLOWED_DOMAINS` to an explicit allowlist, for example `http://localhost:5681,http://127.0.0.1:5681`.\n3. Do not run `kuma-cp` on a machine where you browse untrusted sites.\n\n## Fix\n\nFixed in [#16416](https://github.com/kumahq/kuma/pull/16416), backported to all supported release branches ([#16423](https://github.com/kumahq/kuma/pull/16423), [#16424](https://github.com/kumahq/kuma/pull/16424), [#16425](https://github.com/kumahq/kuma/pull/16425), [#16426](https://github.com/kumahq/kuma/pull/16426), [#16427](https://github.com/kumahq/kuma/pull/16427)).\n\nChanges in patched versions:\n\n- `CorsAllowedDomains` default changed from `[\".*\"]` to `[]` \u2014 CORS is now opt-in; set the env var explicitly if you need GUI access.\n- `LocalhostIsAdmin` hardened: now requires direct loopback `RemoteAddr` and `Host`, and rejects requests carrying proxy-hop headers (`X-Forwarded-For`), cross-site fetch metadata (`Sec-Fetch-Site`), or a non-localhost `Origin`.\n\nUpgrade to a patched version:\n\n- 2.7.25\n- 2.9.15\n- 2.11.13\n- 2.12.10\n- 2.13.5\n\n## Credits\n\nReported by `eldudareeno`.\n\n## CVSS\n\n`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N` = 5.1 Medium.",
  "id": "GHSA-3vcp-chfh-f6r2",
  "modified": "2026-06-09T10:19:22Z",
  "published": "2026-05-14T20:15:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45021"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/16416"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/16423"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/16424"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/16425"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/16426"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/pull/16427"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kumahq/kuma"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-45021 (GCVE-0-2026-45021)

FKIE_CVE-2026-45021

GHSA-3VCP-CHFH-F6R2

Summary

Am I affected?

Mitigation

Fix

Credits

CVSS

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour