Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-45021 Admin Bootstrap Token and Signing Keys Exposure in Kuma Service Mesh https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45021
Post summary
The text announces CVE-2026-45021, describing an exposure of admin bootstrap tokens and signing keys in Kuma Service Mesh, but offers no additional technical, exploit, or remediation details.
CVE-2026-45021 Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the defau… https://www.cve.org/CVERecord?id=CVE-2026-45021
Post summary
The snippet references CVE-2026-45021 and indicates that versions prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5 are affected, implying a patch, but provides no PoC, exploit, or technical details.