Vulnerability · Published Aug 12, 2026 · Assigned by Kong
CVE-2026-18679Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured
Medium 5.8
In plain English
A medium-severity improper certificate validation in Kong Mesh from Kong Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kumahq/kuma | no fix listed | GO-2026-6013 |
| Go | github.com/kumahq/kuma | no fix listed | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.11.14 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.12.11 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.13.7 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.7.26 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | 2.11.14, 2.12.11, 2.13.7, 2.7.26 | GO-2026-6013 |
| Go | github.com/kumahq/kuma/v2 | 2.9.16 | GHSA-wvmp-6r4v-j6cv |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
References
- Upstream advisory GHSA-wvmp-6r4v-j6cv vendor-advisory
- kumahq/kuma#16777 (master) patch
- Kong MESH Changelog release-notes