GO-2026-5102 Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the default configuration of kuma-cp when both CorsAllowedDomains is set to allow all origins and LocalhostIsAdmin is enabled. An attacker can obtain administrative tokens and signing keys by enticing an...