Kong Mesh's default control‑plane configuration allows the admin bootstrap token and signing keys to be exposed through a CORS wildcard. A malicious web page can issue a cross‑origin request that returns the admin JWT and signing material. The weakness is a combination of improper CORS configuration (CWE‑346) and unsafe local‑host privilege validation (CWE‑942), resulting in privileged token leakage that can be used to perform any action on the control plane.

Kong Mesh provided by Kong Inc. is affected on all releases older than 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5. The patched releases, including any line newer than 2.14, are not vulnerable. If a deployment is using a version before these patches, the default configuration remains insecure unless changed manually.

The vulnerability scores a CVSS of 5.1 and has no EPSS score available, indicating a moderate severity and uncertain exploitation likelihood. It is not listed in CISA's KEV catalog. The attack vector is likely local: an operator must visit a malicious page while having browser access to the control plane. A malicious site can then retrieve the admin token and signing keys, enabling full administrative control over the mesh. The exploit requires that CORS is enabled with a wildcard and that the operator has not applied the more restrictive default in newer releases.