{"id":"CVE-2026-18679","aliases":["EUVD-2026-57427","GHSA-wc82-hqx6-g35q","GHSA-wvmp-6r4v-j6cv","GO-2026-6013"],"status":"published","title":"Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","severity":{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00158,"percentile":0.05007,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295"],"published":"2026-07-16T20:09:12Z","modified":"2026-10-28T02:30:40Z","affected":[{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.26"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.8.0"},{"fixed":"2.9.16"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.10.0"},{"fixed":"2.11.14"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.12.0"},{"fixed":"2.12.11"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.13.0"},{"fixed":"2.13.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.26"},{"introduced":"2.9.13"},{"fixed":"2.11.14"},{"introduced":"2.12.4"},{"fixed":"2.12.11"},{"introduced":"2.13.0"},{"fixed":"2.13.7"}]}],"bundled":2}],"products":[{"vendor":"kong inc.","product":"kong mesh"}],"references":[{"url":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv","tags":["vendor-advisory","advisory","web"]},{"url":"https://github.com/kumahq/kuma/pull/16777","tags":["patch","fix","web"]},{"url":"https://developer.konghq.com/mesh/changelog/","tags":["release-notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18679","tags":["advisory"]},{"url":"https://developer.konghq.com/mesh/changelog"},{"url":"https://github.com/advisories/GHSA-wc82-hqx6-g35q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18679.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52724.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52724","tags":["advisory"]},{"url":"https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f","tags":["fix"]},{"url":"https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870","tags":["fix"]},{"url":"https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3","tags":["fix"]},{"url":"https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569","tags":["fix"]},{"url":"https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980","tags":["fix"]},{"url":"https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11","tags":["fix"]},{"url":"https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a","tags":["web","fix"]},{"url":"https://github.com/kumahq/kuma","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-18679","title":"Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","status":"published","published":"2026-08-12T18:52:31.146Z","modified":"2026-08-13T14:45:35.957Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:20:12.939084Z"}],"euvd":[{"id":"EUVD-2026-57427","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","status":"published","published":"2026-08-12T18:52:31Z","modified":"2026-08-13T14:45:35Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"}],"updated_at":"2026-11-02T18:01:56.415282Z"}],"ghsa":[{"id":"GHSA-wc82-hqx6-g35q","title":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA...","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","status":"published","published":"2026-08-12T21:31:40Z","modified":"2026-08-12T21:31:44Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:10:23.958572Z"}],"nvd":[{"id":"CVE-2026-18679","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","status":"published","published":"2026-08-12T20:17:41.957Z","modified":"2026-10-23T19:10:00.167Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-18679","title":"Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","status":"published","published":"2026-08-12T18:52:31.146Z","modified":"2026-10-28T02:30:40.173596867Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"CVE-2026-52724","title":"kuma-dp connects to control plane without verifying TLS certificate when no CA is configured","description":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.","status":"published","published":"2026-09-15T14:50:32.257Z","modified":"2026-10-28T02:30:33.615818459Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"GHSA-wvmp-6r4v-j6cv","title":"kuma-dp connects to control plane without verifying TLS certificate when no CA is configured","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection\n\n## Impact\n\nAn on-path attacker can intercept the dataplane authentication token and impersonate the control plane to the data plane, allowing them to inject a forged bootstrap configuration and take over the proxy\n\n## Affected configurations\n\n- Universal mode `kuma-dp` started against an HTTPS control plane without `--ca-cert-file` (or `KUMA_CONTROL_PLANE_CA_CERT` unset)\n\n## Not affected\n\n- Kubernetes installs done through the standard installers (`kumactl install control-plane` or the official Helm chart). In both cases the control plane's mutating admission webhook injects `KUMA_CONTROL_PLANE_CA_CERT` into every sidecar at pod admission, so each `kuma-dp` starts with the CA already configured\n\n## Workarounds\n\nSet `--ca-cert-file` (or `KUMA_CONTROL_PLANE_CA_CERT`) on every Universal mode data plane and point it at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration\n\n## Resources\n\n- Fix: https://github.com/kumahq/kuma/pull/16777","status":"published","published":"2026-07-16T20:09:12Z","modified":"2026-08-13T04:10:47.070428214Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"GO-2026-6013","title":"kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma","description":"kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/kumahq/kuma/v2 from v2.8.0 before v2.9.16.","status":"published","published":"2026-07-22T20:36:55Z","modified":"2026-08-13T04:10:47.070428214Z","updated_at":"2026-11-02T15:47:02.838915Z"}]}}