CVE-2026-18679
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
- CVSS 4.0
- 5.8
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-25)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wvmp-6r4v-j6cv | Go | github.com/kumahq/kuma/v2 | <2.7.26 | 2.7.26 |
| GHSA-wvmp-6r4v-j6cv | Go | github.com/kumahq/kuma/v2 | >=2.8.0 <2.9.16 | 2.9.16 |
| GHSA-wvmp-6r4v-j6cv | Go | github.com/kumahq/kuma/v2 | >=2.10.0 <2.11.14 | 2.11.14 |
| GHSA-wvmp-6r4v-j6cv | Go | github.com/kumahq/kuma/v2 | >=2.12.0 <2.12.11 | 2.12.11 |
| GHSA-wvmp-6r4v-j6cv | Go | github.com/kumahq/kuma/v2 | >=2.13.0 <2.13.7 | 2.13.7 |
| GHSA-wvmp-6r4v-j6cv | Go | github.com/kumahq/kuma | <=1.8.1 | no fix published |
| GO-2026-6013 | Go | github.com/kumahq/kuma | all versions | no fix published |
| GO-2026-6013 | Go | github.com/kumahq/kuma/v2 | <2.7.26 >=2.9.13 <2.11.14 >=2.12.4 <2.12.11 >=2.13.0 <2.13.7 | 2.7.26, 2.11.14, 2.12.11, 2.13.7 |