Is CVE-2026-45021 actively exploited?

No active exploitation of CVE-2026-45021 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-45021 be exploited remotely?

Yes. CVE-2026-45021 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-45021?

CVE-2026-45021 has a CVSS score of 5.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-45021

MEDIUM

CVE-2026-45021

CWE-346Published: May 28, 2026· Updated: May 28, 2026

5.1

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.5th

Official Description

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.

NVD Source

Technical Analysis

CVE-2026-45021 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (A) is needed, which slightly reduces the risk of mass automated attacks.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionA

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X