CVE-2026-52724

5.8 mediumEPSS 0.4%

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.

CVSS 4.0: 5.8CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS: 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-25)
CWE: CWE-295
Published: 2026-09-15
Modified: 2026-09-30
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-wvmp-6r4v-j6cv	Go	github.com/kumahq/kuma/v2	<2.7.26	2.7.26
GHSA-wvmp-6r4v-j6cv	Go	github.com/kumahq/kuma/v2	>=2.8.0 <2.9.16	2.9.16
GHSA-wvmp-6r4v-j6cv	Go	github.com/kumahq/kuma/v2	>=2.10.0 <2.11.14	2.11.14
GHSA-wvmp-6r4v-j6cv	Go	github.com/kumahq/kuma/v2	>=2.12.0 <2.12.11	2.12.11
GHSA-wvmp-6r4v-j6cv	Go	github.com/kumahq/kuma/v2	>=2.13.0 <2.13.7	2.13.7
GHSA-wvmp-6r4v-j6cv	Go	github.com/kumahq/kuma	<=1.8.1	no fix published
GO-2026-6013	Go	github.com/kumahq/kuma	all versions	no fix published
GO-2026-6013	Go	github.com/kumahq/kuma/v2	<2.7.26 >=2.9.13 <2.11.14 >=2.12.4 <2.12.11 >=2.13.0 <2.13.7	2.7.26, 2.11.14, 2.12.11, 2.13.7

References

Check your stack JSON