Executive brief
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma
Affected products
- Go github.com/kumahq/kuma
- Go github.com/kumahq/kuma/v2
CVE identifiers
- CVE-2026-18676
- CVE-2026-45021
Junglewise Threat Intelligence
CVE-2026-18676: GO-2026-5102 - Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma
CVE-2026-18676 · Severity: medium · CVSS 4 · Published 2026-07-22
Technologies: github.com/kumahq/kuma (Go), github.com/kumahq/kuma/v2 (Go). Vendors: Go.