Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-50166Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Medium 5.5

In plain English

A medium-severity improper certificate validation in kuma from kumahq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.5Medium
Exploit odds (30 days)0.3%top 80.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/kumahq/kumano fix listedGO-2026-6010
Gogithub.com/kumahq/kumano fix listedGHSA-v95x-xhq5-4929
Gogithub.com/kumahq/kuma/v22.11.14GHSA-v95x-xhq5-4929
Gogithub.com/kumahq/kuma/v22.12.11GHSA-v95x-xhq5-4929
Gogithub.com/kumahq/kuma/v22.13.7GHSA-v95x-xhq5-4929
Gogithub.com/kumahq/kuma/v22.7.26GHSA-v95x-xhq5-4929
Gogithub.com/kumahq/kuma/v22.11.14, 2.12.11, 2.13.7, 2.7.26GO-2026-6010
Gogithub.com/kumahq/kuma/v22.9.16GHSA-v95x-xhq5-4929

Affected products (as reported)

VendorProductVersions
kumahq kuma < 2.7.26

Weakness: CWE-295 · Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

References