Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M
CVE-2026-52724kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
Medium 5.8
In plain English
A medium-severity improper certificate validation in kuma from kumahq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kumahq/kuma | no fix listed | GO-2026-6013 |
| Go | github.com/kumahq/kuma | no fix listed | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.11.14 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.12.11 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.13.7 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.7.26 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.11.14, 2.12.11, 2.13.7, 2.7.26 | GO-2026-6013 |
| Go | github.com/kumahq/kuma/v2 | 2.9.16 | GHSA-wvmp-6r4v-j6cv |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
References
- https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv x_refsource_CONFIRM
- https://github.com/kumahq/kuma/pull/16777 x_refsource_MISC
- https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f x_refsource_MISC
- https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870 x_refsource_MISC
- https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3 x_refsource_MISC
- https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569 x_refsource_MISC
- https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980 x_refsource_MISC
- https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11 x_refsource_MISC