CVE Feed

    Dashboard / CVE / CVE-2026-18676

    CVE-2026-18676

    The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

    Published:Aug 12, 2026
    Last Modified:Aug 13, 2026
    EPS:Aug 12, 2026
    EPSS Score:0.0023
    CVSS Score:5.1

    Affected Products

    Vendor
    Konghq
    Product
    Kong Mesh

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-18674 (CVSS 7) — On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using …
    CVE-2026-18679 (CVSS 5.8) — When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the dat…
    CVE-2026-18678 (CVSS 5.5) — When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl di…
    CVE-2026-18677 (CVSS 6) — In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the data…
    CVE-2026-18675 (CVSS 5.3) — The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A toke…
    CVE-2026-18673 (CVSS 5.3) — When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readine…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High