Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin (CVE-2026-18676) | HOL Guard CVE