tocsin

CVE-2026-45021

3 advisories.

Go/github.com/kumahq/kuma CVE-2026-18676, CVE-2026-45021: medium

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Action: Upgrade github.com/kumahq/kuma to 2.7.25 or later.

go get github.com/kumahq/kuma@v2.7.25
go get github.com/kumahq/kuma@v2.9.15
go get github.com/kumahq/kuma@v2.11.13
go get github.com/kumahq/kuma@v2.12.10
go get github.com/kumahq/kuma@v2.13.5

Affected

introducedfixedlast affected
02.7.25-
2.9.02.9.15-
2.11.02.11.13-
2.12.02.12.10-
2.13.02.13.5-

Fixed versions

2.7.252.9.152.11.132.12.102.13.5

Sources

CVE-2026-18676, CVE-2026-45021 · published · modified · JSON

Go/github.com/kumahq/kuma CVE-2026-18676, CVE-2026-45021: unknown

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma

Action: No fix published. Pin and monitor.

Affected

introducedfixedlast affected
0--

Fixed versions

No fixed version in the source.

Sources

CVE-2026-18676, CVE-2026-45021 · published · modified · JSON

Go/github.com/kumahq/kuma/v2 CVE-2026-18676, CVE-2026-45021: unknown

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma

Action: Upgrade github.com/kumahq/kuma/v2 to 2.7.25 or later.

go get github.com/kumahq/kuma/v2@v2.7.25
go get github.com/kumahq/kuma/v2@v2.11.13
go get github.com/kumahq/kuma/v2@v2.12.10
go get github.com/kumahq/kuma/v2@v2.13.5

Affected

introducedfixedlast affected
02.7.25-
2.9.132.11.13-
2.12.42.12.10-
2.13.02.13.5-

Fixed versions

2.7.252.11.132.12.102.13.5

Sources

CVE-2026-18676, CVE-2026-45021 · published · modified · JSON