CVE-2026-45021
Fixed in a distro release EPSS <1%CVSS 5.1
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.
Products: kumahq kuma
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kumahq/kuma | 2.7.25 |
| Go | github.com/kumahq/kuma | 2.9.15 |
| Go | github.com/kumahq/kuma | 2.11.13 |
| Go | github.com/kumahq/kuma | 2.12.10 |
| Go | github.com/kumahq/kuma | 2.13.5 |
| Go | github.com/kumahq/kuma | no fix |
| Go | github.com/kumahq/kuma/v2 | 2.7.25 |
| Go | github.com/kumahq/kuma/v2 | 2.11.13 |
| Go | github.com/kumahq/kuma/v2 | 2.12.10 |
| Go | github.com/kumahq/kuma/v2 | 2.13.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kuma-cni-2.13 | 2.13.5-r0 |
| Chainguard | kuma-cni-2.14 | 0 |
| Chainguard | kuma-cp-2.13 | 2.13.5-r0 |
| Chainguard | kuma-cp-2.14 | 0 |
| Chainguard | kuma-dp-2.13 | 2.13.5-r0 |
| Chainguard | kuma-dp-2.14 | 0 |
| Chainguard | kuma-install-cni-2.13 | 2.13.5-r0 |
| Chainguard | kuma-install-cni-2.14 | 0 |
| Chainguard | kumactl-2.13 | 2.13.5-r0 |
| Chainguard | kumactl-2.14 | 0 |
| Wolfi | kuma-cni-2.13 | 2.13.5-r0 |
| Wolfi | kuma-cp-2.13 | 2.13.5-r0 |
| Wolfi | kuma-dp-2.13 | 2.13.5-r0 |
| Wolfi | kuma-install-cni-2.13 | 2.13.5-r0 |
| Wolfi | kumactl-2.13 | 2.13.5-r0 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |