CVE-2026-18676: Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

Published Aug 12, 2026

Updated

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

Affected Software

1 affected component

Kong Mesh

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kong Mesh to a version that resolves this vulnerability.
Fixed in 2.7.25
Upgrade
Upgrade Kong Mesh to a version that resolves this vulnerability.
Fixed in 2.9.15
Upgrade
Upgrade Kong Mesh to a version that resolves this vulnerability.
Fixed in 2.11.13
Upgrade
Upgrade Kong Mesh to a version that resolves this vulnerability.
Fixed in 2.12.10
Upgrade
Upgrade Kong Mesh to a version that resolves this vulnerability.
Fixed in 2.13.5

Event History

Aug 12, 2026

CVE Published

via MITRE·06:42 PM

Data Sourced

via MITRE·06:42 PM

RemedyDescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-18676?

CVE-2026-18676 has a severity score of 80.

How do I fix CVE-2026-18676?

To fix CVE-2026-18676, update the Kong Mesh configuration to restrict CORS settings and prevent exposure of the admin token.

What impact does CVE-2026-18676 have on my system?

CVE-2026-18676 allows an attacker to steal the admin bootstrap token and signing keys through a cross-origin request.

Who is affected by CVE-2026-18676?

CVE-2026-18676 affects operators of Kong Mesh with default configurations.

What are the main components involved in CVE-2026-18676?

The main components involved in CVE-2026-18676 are the Kong Mesh default kuma-cp configuration and its CORS settings.