Beveiligingsadvies

CVE-2026-18676

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-08-12 18:42:38

Laatst bijgewerkt 2026-08-13 14:50:43

Toegewezen door Kong

CVSS-score 5.1

Status PUBLISHED

Beschrijving

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.

← Alle CVE's bekijken Bekijk op cve.org ↗