The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
You are affected if all of the following hold:
- kuma-cp runs with default config (corsAllowedDomains: [".*"] and localhostIsAdmin: true).
- The control plane is reachable from a browser on the same machine: kuma-cp run on a developer laptop, Docker with host networking or a published port on a workstation, or kubectl port-forward from a machine that also browses the web.
- The operator visits a page running attacker JavaScript while the control plane is reachable.
You are not affected if:
- The control plane runs on a Kubernetes cluster accessed over ClusterIP, NodePort, or LoadBalancer from a remote client.
- The control plane runs on an SSH-administered VM with no browser on the host.
- KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false is set.
- KUMA_API_SERVER_CORS_ALLOWED_DOMAINS is set to an explicit allowlist that excludes attacker origins.
Set KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false after retrieving the admin token, set KUMA_API_SERVER_CORS_ALLOWED_DOMAINS to an explicit allowlist such as http://localhost:5681,http://127.0.0.1:5681, and do not run kuma-cp on a machine used to browse untrusted sites.
Upgrade to Kong Mesh 2.7.25, 2.9.15, 2.11.13, 2.12.10 or 2.13.5, whichever matches your release line. In patched versions the corsAllowedDomains default changed from [".*"] to [], making CORS opt-in, and localhostIsAdmin was hardened to require a direct loopback RemoteAddr and Host and to reject requests carrying proxy-hop headers (X-Forwarded-For), cross-site fetch metadata (Sec-Fetch-Site), or a non-localhost Origin. The 2.14 line shipped after the fix and was never affected.