MEDIUM 5.8 NVD
CVE-2026-18679
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabl
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.
An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
References
- https://developer.konghq.com/mesh/changelog/
- https://github.com/kumahq/kuma/pull/16777
- https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-08-12 via NVD.
vulnfeed aggregates 10542 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.