github.com/kumahq/kuma vulnerabilities (Go)

7 vulnerabilities.

• github.com/kumahq/kuma Go kuma-dp connects to control plane without verifying TLS certificate when no CA is configured CVE-2026-52724 Fix available 5.8 MediumJuly 16, 2026
• github.com/kumahq/kuma Go Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured CVE-2026-18679 5.8 MediumJuly 16, 2026
• github.com/kumahq/kuma Go Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured CVE-2026-50166 Fix available 5.5 MediumJuly 16, 2026
• github.com/kumahq/kuma Go Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured CVE-2026-18678 5.5 MediumJuly 16, 2026
• github.com/kumahq/kuma Go Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin CVE-2026-45021 Fix available 5.1 MediumMay 14, 2026
• github.com/kumahq/kuma Go Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin CVE-2026-18676 5.1 MediumMay 14, 2026
• github.com/kumahq/kuma Go github.com/kumahq/kuma affected by CVE-2023-44487 GHSA-9wmc-rg4h-28wv Fix available 7.5 HighOctober 17, 2023