{"id":"EUVD-2026-32966","revision":"10271caae26846c3b0af5f074b520c45","records":[{"revision":"10271caae26846c3b0af5f074b520c45","observedAt":"2026-11-05T12:39:48.349+00:00","statement":{"source":"euvd","id":"EUVD-2026-32966","aliases":["CVE-2026-45021","GHSA-3vcp-chfh-f6r2"],"title":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any …","description":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.1,"severity":null}],"references":["https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2","https://github.com/kumahq/kuma/pull/16416","https://github.com/kumahq/kuma/pull/16423","https://github.com/kumahq/kuma/pull/16424","https://github.com/kumahq/kuma/pull/16425","https://github.com/kumahq/kuma/pull/16426","https://github.com/kumahq/kuma/pull/16427","https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32966","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 28, 2026, 5:45:14 PM","dateUpdated":"May 28, 2026, 7:30:33 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-32966","identifiers":["EUVD-2026-32966","CVE-2026-45021","GHSA-3vcp-chfh-f6r2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}