Medium severityNVD Advisory· Published Aug 12, 2026
CVE-2026-18676
CVE-2026-18676
Description
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
8- developer.konghq.com/mesh/changelog/nvd
- github.com/kumahq/kuma/pull/16416nvd
- github.com/kumahq/kuma/pull/16423nvd
- github.com/kumahq/kuma/pull/16424nvd
- github.com/kumahq/kuma/pull/16425nvd
- github.com/kumahq/kuma/pull/16426nvd
- github.com/kumahq/kuma/pull/16427nvd
- github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2nvd
News mentions
0No linked articles in our index yet.