CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

[
  {
    "vendor": "Kong Inc.",
    "product": "Kong Mesh",
    "platforms": [
      "Linux"
    ],
    "modules": [
      "kuma-cp"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.7.25",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.8.0",
        "lessThan": "2.9.15",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.10.0",
        "lessThan": "2.11.13",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.12.0",
        "lessThan": "2.12.10",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.13.0",
        "lessThan": "2.13.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]