Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/kumahq/kuma | go | < 2.7.25 | 2.7.25 |
| github.com/kumahq/kuma | go | >= 2.9.0, < 2.9.15 | 2.9.15 |
| github.com/kumahq/kuma | go | >= 2.11.0, < 2.11.13 | 2.11.13 |
| github.com/kumahq/kuma | go | >= 2.12.0, < 2.12.10 | 2.12.10 |
| github.com/kumahq/kuma | go | >= 2.13.0, < 2.13.5 | 2.13.5 |
Miggo AIRoot Cause AnalysisThe vulnerability is caused by a combination of two insecure default settings in kuma-cp. First, the Cross-Origin Resource Sharing (CORS) policy, configured in DefaultApiServerConfig, defaulted to [".*"],allowing any web page from any origin to send requests to thekuma-cpAPI server. Second, theLocalhostAuthenticator function, which checks if a request should be granted admin privileges, only verified that the request originated from a loopback IP address (127.0.0.1or::1`).
An attacker could exploit this by convincing a user running kuma-cp locally to visit a malicious website. The JavaScript on this website could then make a fetch() request to the kuma-cp API server running on localhost. The browser would send this request from the loopback address, satisfying the weak check in LocalhostAuthenticator and thus gaining admin access. The permissive CORS policy ensured the browser would not block this cross-origin request.
The patch addresses both issues. It changes the LocalhostAuthenticator to perform much stricter checks, ensuring the request is a direct call to localhost and not a cross-origin request from a browser. It also changes the default CORS policy to be restrictive ([]), requiring users to explicitly enable cross-origin access if needed.
authn.LocalhostAuthenticatorpkg/api-server/authn/localhost.go
config.DefaultApiServerConfigpkg/config/api-server/config.go