CyberRota Analysis
AI-GeneratedThe default configuration of Kong Mesh exposes the admin bootstrap token and signing keys to any webpage accessed by the operator, due to a CORS misconfiguration. This vulnerability allows malicious pages to perform cross-origin requests, potentially compromising the admin JWT and signing materials. Organizations using Kong Mesh should prioritize addressing this issue to safeguard their control plane from unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.