CVE-2026-45021
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs
Published: 2026-05-28 · Last updated: 2026-05-28
Severity and scoring
- CWE
- CWE-346, CWE-942
Description
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-45021
- [Other]https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907
- [Other]https://github.com/kumahq/kuma/pull/16416
- [Other]https://github.com/kumahq/kuma/pull/16423
- [Other]https://github.com/kumahq/kuma/pull/16424
- [Other]https://github.com/kumahq/kuma/pull/16425
- [Other]https://github.com/kumahq/kuma/pull/16426
- [Other]https://github.com/kumahq/kuma/pull/16427
- [Other]https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2
Related CVEs
Same CWE
- CVE-2026-45173 — Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its...
- CVE-2026-12032 — Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromis... (3.1 LOW)
- CVE-2026-41700 — Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking (8.1 HIGH)
- CVE-2026-42558 — Xibo is an open source digital signage platform with a web content management system and Windows display player software (7.6 HIGH)
- CVE-2026-10846 — NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query...