VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions 1 Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/18xxx/CVE-2026-18676.json
T

301 lines
15 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-18676",
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"state": "PUBLISHED",
"assignerShortName": "Kong",
"dateReserved": "2026-08-03T15:20:44.526Z",
"datePublished": "2026-08-12T18:42:38.843Z",
"dateUpdated": "2026-08-13T14:50:43.069Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"shortName": "Kong",
"dateUpdated": "2026-08-12T18:43:32.594Z"
},
"title": "Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-942",
"description": "CWE-942 Permissive Cross-domain Policy with Untrusted Domain",
"type": "CWE"
}
]
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Credential disclosure"
}
]
}
],
"affected": [
{
"vendor": "Kong Inc.",
"product": "Kong Mesh",
"platforms": [
"Linux"
],
"modules": [
"kuma-cp"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.7.25",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.8.0",
"lessThan": "2.9.15",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.10.0",
"lessThan": "2.11.13",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.12.0",
"lessThan": "2.12.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.13.0",
"lessThan": "2.13.5",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>The default <code>kuma-cp</code> configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser.&nbsp;Due to a CORS misconfiguration a cross-origin <code>fetch()</code> from a malicious page returns the admin JWT and signing material.</p>"
}
]
}
],
"references": [
{
"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2",
"name": "Upstream advisory GHSA-3vcp-chfh-f6r2",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://github.com/kumahq/kuma/pull/16416",
"name": "kumahq/kuma#16416 (master)",
"tags": [
"patch"
]
},
{
"url": "https://github.com/kumahq/kuma/pull/16423",
"name": "kumahq/kuma#16423 (backport)",
"tags": [
"patch"
]
},
{
"url": "https://github.com/kumahq/kuma/pull/16424",
"name": "kumahq/kuma#16424 (backport)",
"tags": [
"patch"
]
},
{
"url": "https://github.com/kumahq/kuma/pull/16425",
"name": "kumahq/kuma#16425 (backport)",
"tags": [
"patch"
]
},
{
"url": "https://github.com/kumahq/kuma/pull/16426",
"name": "kumahq/kuma#16426 (backport)",
"tags": [
"patch"
]
},
{
"url": "https://github.com/kumahq/kuma/pull/16427",
"name": "kumahq/kuma#16427 (backport)",
"tags": [
"patch"
]
},
{
"url": "https://developer.konghq.com/mesh/changelog/",
"name": "Kong MESH Changelog",
"tags": [
"release-notes"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV4_0": {
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"subIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"version": "4.0",
"baseSeverity": "MEDIUM",
"baseScore": 5.1,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
}
}
],
"configurations": [
{
"lang": "en",
"value": "You are affected if all of the following hold:\n\n * kuma-cp runs with default config (corsAllowedDomains: [\".*\"] and localhostIsAdmin: true).\n * The control plane is reachable from a browser on the same machine: kuma-cp run on a developer laptop, Docker with host networking or a published port on a workstation, or kubectl port-forward from a machine that also browses the web.\n * The operator visits a page running attacker JavaScript while the control plane is reachable.\n\n\n\n\nYou are not affected if:\n\n * The control plane runs on a Kubernetes cluster accessed over ClusterIP, NodePort, or LoadBalancer from a remote client.\n * The control plane runs on an SSH-administered VM with no browser on the host.\n * KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false is set.\n * KUMA_API_SERVER_CORS_ALLOWED_DOMAINS is set to an explicit allowlist that excludes attacker origins.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>You are affected if all of the following hold:</p><ul><li><code>kuma-cp</code> runs with default config (<code>corsAllowedDomains: [&quot;.*&quot;]</code> and <code>localhostIsAdmin: true</code>).</li><li>The control plane is reachable from a browser on the same machine: <code>kuma-cp run</code> on a developer laptop, Docker with host networking or a published port on a workstation, or <code>kubectl port-forward</code> from a machine that also browses the web.</li><li>The operator visits a page running attacker JavaScript while the control plane is reachable.</li></ul><p>You are not affected if:</p><ul><li>The control plane runs on a Kubernetes cluster accessed over ClusterIP, NodePort, or LoadBalancer from a remote client.</li><li>The control plane runs on an SSH-administered VM with no browser on the host.</li><li><code>KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false</code> is set.</li><li><code>KUMA_API_SERVER_CORS_ALLOWED_DOMAINS</code> is set to an explicit allowlist that excludes attacker origins.</li></ul>"
}
]
}
],
"workarounds": [
{
"lang": "en",
"value": "Set KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false after retrieving the admin token, set KUMA_API_SERVER_CORS_ALLOWED_DOMAINS to an explicit allowlist such as http://localhost:5681,http://127.0.0.1:5681, and do not run kuma-cp on a machine used to browse untrusted sites.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Set <code>KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false</code> after retrieving the admin token, set <code>KUMA_API_SERVER_CORS_ALLOWED_DOMAINS</code> to an explicit allowlist such as <code>http://localhost:5681,http://127.0.0.1:5681</code>, and do not run <code>kuma-cp</code> on a machine used to browse untrusted sites.</p>"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Kong Mesh 2.7.25, 2.9.15, 2.11.13, 2.12.10 or 2.13.5, whichever matches your release line. In patched versions the corsAllowedDomains default changed from [\".*\"] to [], making CORS opt-in, and localhostIsAdmin was hardened to require a direct loopback RemoteAddr and Host and to reject requests carrying proxy-hop headers (X-Forwarded-For), cross-site fetch metadata (Sec-Fetch-Site), or a non-localhost Origin. The 2.14 line shipped after the fix and was never affected.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Upgrade to Kong Mesh 2.7.25, 2.9.15, 2.11.13, 2.12.10 or 2.13.5, whichever matches your release line. In patched versions the <code>corsAllowedDomains</code> default changed from <code>[&quot;.*&quot;]</code> to <code>[]</code>, making CORS opt-in, and <code>localhostIsAdmin</code> was hardened to require a direct loopback <code>RemoteAddr</code> and <code>Host</code> and to reject requests carrying proxy-hop headers (<code>X-Forwarded-For</code>), cross-site fetch metadata (<code>Sec-Fetch-Site</code>), or a non-localhost <code>Origin</code>. The 2.14 line shipped after the fix and was never affected.</p>"
}
]
}
],
"timeline": [
{
"time": "2026-05-01T07:01:00.000Z",
"lang": "en",
"value": "Kong Mesh patched releases published"
},
{
"time": "2026-05-09T06:15:00.000Z",
"lang": "en",
"value": "Upstream advisory GHSA-3vcp-chfh-f6r2 published"
}
],
"credits": [
{
"lang": "en",
"value": "eldudareeno",
"type": "finder"
}
],
"source": {
"discovery": "EXTERNAL"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-08-13T14:50:34.609630Z",
"id": "CVE-2026-18676",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-08-13T14:50:43.069Z"
}
}
]
}
}
View Git Blame Copy Permalink