The vulnerability arises from default Kuma control-plane configuration that permits any HTTP origin to request the admin bootstrap token and signing keys. By using a wildcard CORS policy and enabling LocalhostIsAdmin, an attacker who gains access to the same network or can embed a malicious page that can reach the control plane can perform a cross‑origin fetch to retrieve these credentials. The leaked JWT and signing materials allow an attacker to authenticate as the mesh‑system admin and potentially compromise the entire service mesh, creating a full system takeover. The weakness is a type of improper authentication and trust boundary bypass, classified as CWE-346 and CWE-942.

Affected versions of Kuma include 2.7.24 and older, 2.9.14 and older, 2.11.12 and older, 2.12.9 and older, and 2.13.4 and older. These are versions that still ship with the default CorsAllowedDomains set to ".*" and LocalhostIsAdmin enabled.

The CVSS score of 5.1 indicates a moderate risk, but the exploitation requires only a browser with network access to the control plane. Attackers can trigger the vulnerability by loading a crafted page that issues a fetch request to the admin API. The EPSS score is not available, so exact likelihood is unknown, but the vulnerability is not listed in the CISA KEV catalog, which may indicate lower known exploitation focus at this time. Nevertheless, because the exposed credentials grant administrative access, the potential impact is severe once the token is obtained.