CVE-2026-45021

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.

CVSS

No CVSS.

References

Link	Resource
https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907
https://github.com/kumahq/kuma/pull/16416
https://github.com/kumahq/kuma/pull/16423
https://github.com/kumahq/kuma/pull/16424
https://github.com/kumahq/kuma/pull/16425
https://github.com/kumahq/kuma/pull/16426
https://github.com/kumahq/kuma/pull/16427
https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Kuma es una malla de servicios moderna basada en Envoy que puede ejecutarse en cualquier nube tanto en Kubernetes como en VMs. Antes de 2.7.25, 2.9.15, 2.11.13, 2.12.10 y 2.13.5, la configuración predeterminada de kuma-cp filtra el token de arranque de administrador y las claves de firma a cualquier página web que el operador visite mientras el plano de control es accesible desde su navegador. CorsAllowedDomains: [’.*’] refleja cualquier Origen, y LocalhostIsAdmin: true promueve las solicitudes de 127.0.0.1 a mesh-system:admin. Una llamada fetch() de origen cruzado desde una página maliciosa devuelve el JWT de administrador y el material de firma. Esta vulnerabilidad está corregida en 2.7.25, 2.9.15, 2.11.13, 2.12.10 y 2.13.5.

Information

Published : 2026-05-28 18:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-45021

Mitre link : CVE-2026-45021

CVE.ORG link : CVE-2026-45021

JSON object : View

Products Affected

No product.

CWE

CWE-346

Origin Validation Error

CWE-942

Permissive Cross-domain Security Policy with Untrusted Domains

{"id": "CVE-2026-45021", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45021", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T19:30:17.834875Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kumahq", "product": "kuma", "versions": [{"status": "affected", "version": "< 2.7.25"}, {"status": "affected", "version": ">= 2.9.0, < 2.9.15"}, {"status": "affected", "version": ">= 2.11.0, < 2.11.13"}, {"status": "affected", "version": ">= 2.12.0, < 2.12.10"}, {"status": "affected", "version": ">= 2.13.0, < 2.13.5"}]}]}], "published": "2026-05-28T18:16:34.167", "references": [{"url": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907", "source": "security-advisories@github.com"}, {"url": "https://github.com/kumahq/kuma/pull/16416", "source": "security-advisories@github.com"}, {"url": "https://github.com/kumahq/kuma/pull/16423", "source": "security-advisories@github.com"}, {"url": "https://github.com/kumahq/kuma/pull/16424", "source": "security-advisories@github.com"}, {"url": "https://github.com/kumahq/kuma/pull/16425", "source": "security-advisories@github.com"}, {"url": "https://github.com/kumahq/kuma/pull/16426", "source": "security-advisories@github.com"}, {"url": "https://github.com/kumahq/kuma/pull/16427", "source": "security-advisories@github.com"}, {"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-942"}]}], "descriptions": [{"lang": "en", "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5."}, {"lang": "es", "value": "Kuma es una malla de servicios moderna basada en Envoy que puede ejecutarse en cualquier nube tanto en Kubernetes como en VMs. Antes de 2.7.25, 2.9.15, 2.11.13, 2.12.10 y 2.13.5, la configuraci\u00f3n predeterminada de kuma-cp filtra el token de arranque de administrador y las claves de firma a cualquier p\u00e1gina web que el operador visite mientras el plano de control es accesible desde su navegador. CorsAllowedDomains: [\u2019.*\u2019] refleja cualquier Origen, y LocalhostIsAdmin: true promueve las solicitudes de 127.0.0.1 a mesh-system:admin. Una llamada fetch() de origen cruzado desde una p\u00e1gina maliciosa devuelve el JWT de administrador y el material de firma. Esta vulnerabilidad est\u00e1 corregida en 2.7.25, 2.9.15, 2.11.13, 2.12.10 y 2.13.5."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}