Executive brief
A security issue in the Kuma service mesh control plane could allow a malicious website to steal administrative credentials. If an administrator visits a compromised website while running the Kuma control plane locally (such as during development or via port-forwarding), the website can silently capture the admin token. This could allow an attacker to gain unauthorized administrative control over the service mesh infrastructure.
Technical details
The vulnerability arises from two default configurations in kuma-cp: 'CorsAllowedDomains' being set to a wildcard (.*) and 'LocalhostIsAdmin' being set to true. When an operator accesses the control plane via a browser on the same machine (e.g., via localhost or kubectl port-forward), the application promotes the request to administrative status. Because of the permissive CORS policy, a malicious third-party website visited by the operator can perform a cross-origin fetch() to the local API and retrieve the admin JWT and signing keys. Patched versions harden 'LocalhostIsAdmin' by requiring direct loopback addresses and rejecting requests with proxy headers or cross-site fetch metadata.
Affected products
- Kumahq Kuma < 2.7.25, >= 2.9.0 < 2.9.15, >= 2.11.0 < 2.11.13, >= 2.12.0 < 2.12.10, >= 2.13.0 < 2.13.5
Timeline
- 2026-04-27: other: Fix PR submitted
- 2026-05-09: disclosed: Advisory published by vendor
- 2026-05-14: advisory: GitHub Advisory published
- 2026-05-28: advisory: NVD published CVE-2026-45021