01 Record index
Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin
Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
Upgrade to Kong Mesh 2.7.25, 2.9.15, 2.11.13, 2.12.10 or 2.13.5, whichever matches your release line. In patched versions the corsAllowedDomains default changed from [".*"] to [], making CORS opt-in, and localhostIsAdmin was hardened to require a direct loopback RemoteAddr and Host and to reject requests carrying proxy-hop headers (X-Forwarded-For), cross-site fetch metadata (Sec-Fetch-Site), or a non-localhost Origin. The 2.14 line shipped after the fix and was never affected.