Description
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kong | Kong Mesh | < 2.7.25, 2.8.0 – < 2.9.15, 2.10.0 – < 2.11.13, 2.12.0 – < 2.12.10, 2.13.0 – < 2.13.5 | 2.7.25 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kumahq/kuma | < 2.7.25 | 2.7.25 | GHSA-3vcp-chfh-f6r2 |
| Go | github.com/kumahq/kuma | >= 2.9.0, < 2.9.15 | 2.9.15 | GHSA-3vcp-chfh-f6r2 |
| Go | github.com/kumahq/kuma | >= 2.11.0, < 2.11.13 | 2.11.13 | GHSA-3vcp-chfh-f6r2 |
| Go | github.com/kumahq/kuma | >= 2.12.0, < 2.12.10 | 2.12.10 | GHSA-3vcp-chfh-f6r2 |
| Go | github.com/kumahq/kuma | >= 2.13.0, < 2.13.5 | 2.13.5 | GHSA-3vcp-chfh-f6r2 |
| Go | github.com/kumahq/kuma | all versions | — | GO-2026-5102 |
| Go | github.com/kumahq/kuma/v2 | < 2.7.25 · >= 2.9.13, < 2.11.13 · >= 2.12.4, < 2.12.10 · >= 2.13.0, < 2.13.5 | 2.7.25, 2.11.13, 2.12.10, 2.13.5 | GO-2026-5102 |
References
- Upstream advisory GHSA-3vcp-chfh-f6r2 vendor-advisory
- kumahq/kuma#16416 (master) patch
- kumahq/kuma#16423 (backport) patch
- kumahq/kuma#16424 (backport) patch
- kumahq/kuma#16425 (backport) patch
- kumahq/kuma#16426 (backport) patch
- kumahq/kuma#16427 (backport) patch
- Kong MESH Changelog release-notes