{"id":"EUVD-2026-32966","enisaUuid":"152b247e-220c-3bfd-98e2-e546cf4508f7","description":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.","datePublished":"May 28, 2026, 5:45:14 PM","dateUpdated":"May 28, 2026, 7:30:33 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2\nhttps://github.com/kumahq/kuma/pull/16416\nhttps://github.com/kumahq/kuma/pull/16423\nhttps://github.com/kumahq/kuma/pull/16424\nhttps://github.com/kumahq/kuma/pull/16425\nhttps://github.com/kumahq/kuma/pull/16426\nhttps://github.com/kumahq/kuma/pull/16427\nhttps://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907\n","aliases":"CVE-2026-45021\nGHSA-3vcp-chfh-f6r2\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"16fbe171-28e0-3ad8-b848-0606ef5b750d","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.12.0, \u003c 2.12.10"},{"id":"a2dd404d-60dd-303a-bdb5-7ea46ac4c351","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.11.0, \u003c 2.11.13"},{"id":"d27c6023-bacd-33df-b22b-eb1c3d729b21","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.9.0, \u003c 2.9.15"},{"id":"f5f0b3d0-934f-3062-8891-7c985f28269a","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"\u003c 2.7.25"},{"id":"f9043c98-ae7b-3cc7-afdb-d874f2ea9483","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.13.0, \u003c 2.13.5"}],"enisaIdVendor":[{"id":"90cc5914-668d-3092-9b51-2b5facf76fbb","vendor":{"name":"kumahq"}}],"enisaIdVulnerability":[{"id":"91f76fd8-c01e-3f90-8284-9c9a0750e011","vulnerability":{"id":"GHSA-3vcp-chfh-f6r2","description":"Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin","datePublished":"May 14, 2026, 8:15:08 PM","dateUpdated":"Jun 9, 2026, 10:19:22 AM","baseScore":0.0,"references":"https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45021\nhttps://github.com/kumahq/kuma/pull/16416\nhttps://github.com/kumahq/kuma/pull/16423\nhttps://github.com/kumahq/kuma/pull/16424\nhttps://github.com/kumahq/kuma/pull/16425\nhttps://github.com/kumahq/kuma/pull/16426\nhttps://github.com/kumahq/kuma/pull/16427\nhttps://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907\nhttps://github.com/kumahq/kuma\n","enisa_id":"EUVD-2026-32966\n","aliases":"CVE-2026-45021\nGHSA-3vcp-chfh-f6r2\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d7863180-8021-3b83-a246-c94f3d358883","vulnerability":{"id":"CVE-2026-45021","description":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.","datePublished":"May 28, 2026, 5:45:14 PM","dateUpdated":"May 28, 2026, 7:30:33 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2\nhttps://github.com/kumahq/kuma/pull/16416\nhttps://github.com/kumahq/kuma/pull/16423\nhttps://github.com/kumahq/kuma/pull/16424\nhttps://github.com/kumahq/kuma/pull/16425\nhttps://github.com/kumahq/kuma/pull/16426\nhttps://github.com/kumahq/kuma/pull/16427\nhttps://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907\n","enisa_id":"EUVD-2026-32966\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Nov 7, 2026, 7:21:28 AM","vulnerabilityProduct":[{"id":"0eba24de-d4af-3e30-9e1f-c67b45794c36","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.9.0, \u003c 2.9.15"},{"id":"10c0d3ea-0f23-31a8-88f0-f268289d593e","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.11.0, \u003c 2.11.13"},{"id":"1d9839da-f4b3-3b01-9923-f453874d1a8f","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"\u003c 2.7.25"},{"id":"9316bfe7-f18e-3f56-b9b0-e876f4f0ea95","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.13.0, \u003c 2.13.5"},{"id":"c3ff5c9e-4f39-36cd-a669-7fe6cd474903","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.12.0, \u003c 2.12.10"}],"vulnerabilityVendor":[{"id":"9b792c8e-5e01-3f7a-9398-1c3a9621cbf4","vendor":{"name":"kumahq"}}]}}],"enisaIdAdvisory":[]}