What is CVE-2026-45021?

CVE-2026-45021 is a medium-severity security vulnerability in github.com/kumahq/kuma (go), affecting versions < 2.7.25. It is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, 2.13.5.

Which versions of github.com/kumahq/kuma are affected by CVE-2026-45021?

github.com/kumahq/kuma (go) versions < 2.7.25 is affected.

Is there a fix for CVE-2026-45021?

Yes. CVE-2026-45021 is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, 2.13.5. Upgrade to this version or later.

Is CVE-2026-45021 exploitable, and should I be worried?

Whether CVE-2026-45021 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-45021 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-45021?

Upgrade: github.com/kumahq/kuma to 2.7.25 or later, github.com/kumahq/kuma to 2.9.15 or later, github.com/kumahq/kuma to 2.11.13 or later, github.com/kumahq/kuma to 2.12.10 or later, github.com/kumahq/kuma to 2.13.5 or later.

CVE-2026-45021 in github.com/kumahq/kuma

Q: Which versions of github.com/kumahq/kuma are affected by CVE-2026-45021?

github.com/kumahq/kuma (go) versions < 2.7.25 is affected.

Q: Is there a fix for CVE-2026-45021?

Yes. CVE-2026-45021 is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, 2.13.5. Upgrade to this version or later.

Q: Is CVE-2026-45021 exploitable, and should I be worried?

Whether CVE-2026-45021 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-45021 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-45021?

Upgrade: github.com/kumahq/kuma to 2.7.25 or later, github.com/kumahq/kuma to 2.9.15 or later, github.com/kumahq/kuma to 2.11.13 or later, github.com/kumahq/kuma to 2.12.10 or later, github.com/kumahq/kuma to 2.13.5 or later.

Summary

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material.

Am I affected?

You are affected if all of these hold:

kuma-cp runs with default config (CorsAllowedDomains: [".*"] and LocalhostIsAdmin: true).
The control plane is reachable from a browser on the same machine:
- kuma-cp run on a developer laptop
- Docker --network host or port-publish on a workstation
- kubectl port-forward from a machine that also browses the web
The operator visits a page running attacker JavaScript while the control plane is reachable.

You are not affected if:

The control plane runs on a Kubernetes cluster accessed via ClusterIP, NodePort, or LoadBalancer from a remote client.
The control plane runs on an SSH-administered VM with no browser on the host.
KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false is set (see https://kuma.io/docs/latest/production/secure-deployment/api-server-auth/).
KUMA_API_SERVER_CORS_ALLOWED_DOMAINS is set to an explicit allowlist that excludes attacker origins.

Mitigation

Set KUMA_API_SERVER_AUTHN_LOCALHOST_IS_ADMIN=false after retrieving the admin token.
Set KUMA_API_SERVER_CORS_ALLOWED_DOMAINS to an explicit allowlist, for example http://localhost:5681,http://127.0.0.1:5681.
Do not run kuma-cp on a machine where you browse untrusted sites.

Credits

Reported by eldudareeno.

CVSS

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N = 5.1 Medium.

Impact

Affected versions

github.com/kumahq/kuma (< 2.7.25) github.com/kumahq/kuma (>= 2.9.0, < 2.9.15) github.com/kumahq/kuma (>= 2.11.0, < 2.11.13) github.com/kumahq/kuma (>= 2.12.0, < 2.12.10) github.com/kumahq/kuma (>= 2.13.0, < 2.13.5)

Security releases

github.com/kumahq/kuma → 2.7.25 (go) github.com/kumahq/kuma → 2.9.15 (go) github.com/kumahq/kuma → 2.11.13 (go) github.com/kumahq/kuma → 2.12.10 (go) github.com/kumahq/kuma → 2.13.5 (go)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Fixed in #16416, backported to all supported release branches (#16423, #16424, #16425, #16426, #16427).

Changes in patched versions:

CorsAllowedDomains default changed from [".*"] to [], CORS is now opt-in; set the env var explicitly if you need GUI access.
LocalhostIsAdmin hardened: now requires direct loopback RemoteAddr and Host, and rejects requests carrying proxy-hop headers (X-Forwarded-For), cross-site fetch metadata (Sec-Fetch-Site), or a non-localhost Origin.

Upgrade to a patched version:

2.7.25
2.9.15
2.11.13
2.12.10
2.13.5

Frequently Asked Questions

What is CVE-2026-45021? CVE-2026-45021 is a medium-severity security vulnerability in github.com/kumahq/kuma (go), affecting versions < 2.7.25. It is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, 2.13.5.
Which versions of github.com/kumahq/kuma are affected by CVE-2026-45021? github.com/kumahq/kuma (go) versions < 2.7.25 is affected.
Is there a fix for CVE-2026-45021? Yes. CVE-2026-45021 is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, 2.13.5. Upgrade to this version or later.
Is CVE-2026-45021 exploitable, and should I be worried? Whether CVE-2026-45021 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-45021 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-45021?
- Upgrade github.com/kumahq/kuma to 2.7.25 or later
- Upgrade github.com/kumahq/kuma to 2.9.15 or later
- Upgrade github.com/kumahq/kuma to 2.11.13 or later
- Upgrade github.com/kumahq/kuma to 2.12.10 or later
- Upgrade github.com/kumahq/kuma to 2.13.5 or later

Other vulnerabilities in github.com/kumahq/kuma

CVE-IDSeverityPackage summary

GHSA-9WMC-RG4H-28WVHighgithub.com/kumahq/kuma: github.com/kumahq/kuma affected by CVE-2023-44487