CVE-2026-45021 Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is...

EUVD-2026-32966

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is...

CVE-2026-45021 Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is...

CVE-2026-45021 Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is...

CVE-2026-45021

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is...

Kuma 安全漏洞

Kuma is a modern service mesh developed by Kuma OpenSource, based on Envoy. It can be run on Kubernetes and VMs, with single- or multi-zone capabilities, across various clouds. There were security vulnerabilities in versions of Kuma before 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5. These...

GHSA-3VCP-CHFH-F6R2 Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Summary Default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: "." reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin...

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Summary Default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: "." reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: zarf, cert-manager-cmctl, cilium-cli, kuma, rancher-fleet, kots, helm-push, flux-source-controller, flux...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: zarf, cert-manager-cmctl, cilium-cli, kuma, rancher-fleet, kots, helm-push, flux-source-controller, flux...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: zarf, cert-manager-cmctl, cilium-cli, kuma, rancher-fleet, kots, helm-push, flux-source-controller, flux...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: zarf, cert-manager-cmctl, cilium-cli, kuma, rancher-fleet, kots, helm-push, flux-source-controller, flux...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: k9s, tigera-operator, kuma, rancher-fleet, helm-push, chart-testing, zarf, helm-set-status, flux, pluto, envoy-gateway, headlamp, nova, kube-arangodb, helm-mapkubeapis, k8ssandra-client, cluster-api-helm-controller, helm-docs, cert-manager-cmctl, cerbos, trivy, zot,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: k9s, tigera-operator, kuma, rancher-fleet, helm-push, chart-testing, zarf, helm-set-status, flux, pluto, envoy-gateway, headlamp, nova, kube-arangodb, helm-mapkubeapis, k8ssandra-client, cluster-api-helm-controller, helm-docs, cert-manager-cmctl, cerbos, trivy, zot,...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: zarf, rancher-fleet, kuma, helm-push, flux-fips, flux-source-controller-fips, helm-diff, rancher-fleet-fips, cert-manager-cmctl-fips, helm-diff-fips, flux-source-controller, cert-manager-cmctl, gitlab-operator-fips, flux, kots, gitlab-operator, cilium-cli, zarf-fips...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: zarf, rancher-fleet, kuma, helm-push, flux-fips, flux-source-controller-fips, helm-diff, rancher-fleet-fips, cert-manager-cmctl-fips, helm-diff-fips, flux-source-controller, cert-manager-cmctl, gitlab-operator-fips, flux, kots, gitlab-operator, cilium-cli, zarf-fips...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: zarf, rancher-fleet, kuma, helm-push, flux-fips, flux-source-controller-fips, helm-diff, rancher-fleet-fips, cert-manager-cmctl-fips, helm-diff-fips, flux-source-controller, cert-manager-cmctl, gitlab-operator-fips, flux, kots, gitlab-operator, cilium-cli, zarf-fips...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: zarf, rancher-fleet, kuma, helm-push, flux-fips, flux-source-controller-fips, helm-diff, rancher-fleet-fips, cert-manager-cmctl-fips, helm-diff-fips, flux-source-controller, cert-manager-cmctl, gitlab-operator-fips, flux, kots, gitlab-operator, cilium-cli, zarf-fips...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: nova, helm-exporter-fips, zarf, helm-mapkubeapis, kubescape-server, helm-push, flux-fips, chart-testing, helm-diff, kube-arangodb, linkerd2-fips, cluster-api-helm-controller, consul-k8s, pluto, cloudbeat, cerbos, gitlab-operator-fips, headlamp, gitlab-operator,...

CVE-2026-32230

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...