Every CVE Search/ Get API key

CVE-2026-18678

Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

5.5 Medium

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.13%Unchanged since Aug 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.5

Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

Record
CVE-2026-18678
CVSS 4.0
5.5 MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2026-57425 5.5

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

Record
EUVD-2026-57425
CVSS 4.0
5.5 MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-26pg-x7g5-9g43 5.5

When an operator adds an HTTPS control plane profile to kumactl without providing a CA...

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

Record
GHSA-26pg-x7g5-9g43
CVSS 4.0
5.5 MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-295
Updated
2026-11-02
NVD 5.5

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

Record
CVE-2026-18678
CVSS 4.0
5.5 MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-295
Updated
2026-11-02
OSV 5.5

Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

Record
CVE-2026-18678
CVSS 4.0
5.5 MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-295
Updated
2026-11-02
OSVCVE-2026-50166 5.5

Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.

Record
CVE-2026-50166
CVSS 4.0
5.5 MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-295
Updated
2026-11-02
OSVGHSA-v95x-xhq5-4929 5.5

kumactl connects to control plane without verifying TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection

Impact

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user

Affected configurations

  • kumactl profiles manually added against an HTTPS control plane endpoint without --ca-cert-file

Not affected

  • The default local profile, which uses plain HTTP

Workarounds

When adding an HTTPS control plane profile to kumactl, always pass --ca-cert-file pointing at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration

Resources

Record
GHSA-v95x-xhq5-4929
CVSS 4.0
5.5 MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-295
Updated
2026-11-02
OSVGO-2026-6010 No score

kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma

kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/kumahq/kuma/v2 from v2.8.0 before v2.9.16.

Record
GO-2026-6010
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/kumahq/kuma/v2
Go
From an advisory covering 2 CVEs
 before 2.7.26
2.7.26
github.com/kumahq/kuma/v2
Go
From an advisory covering 2 CVEs
 2.8.0 up to 2.9.16
2.9.16
github.com/kumahq/kuma/v2
Go
From an advisory covering 2 CVEs
 2.10.0 up to 2.11.14
2.11.14
github.com/kumahq/kuma/v2
Go
From an advisory covering 2 CVEs
 2.12.0 up to 2.12.11
2.12.11
github.com/kumahq/kuma/v2
Go
From an advisory covering 2 CVEs
 2.13.0 up to 2.13.7
2.13.7
github.com/kumahq/kuma
Go
From an advisory covering 2 CVEs
 through 1.8.1 None known
github.com/kumahq/kuma
Go
From an advisory covering 2 CVEs
 All versions None known
github.com/kumahq/kuma/v2
Go
From an advisory covering 2 CVEs
 before 2.7.26, 2.9.13 up to 2.11.14, 2.12.4 up to 2.12.11, 2.13.0 up to 2.13.7
2.7.262.11.142.12.112.13.7

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-18678 is a medium vulnerability (CVSS 5.5) in Kong Inc. Mesh, published July 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open