MEDIUM 5.5 NVD
CVE-2026-50166
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a k
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
References
- https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f
- https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870
- https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3
- https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569
- https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980
This medium severity vulnerability with a CVSS score of 5.5 was published on 2026-09-15 via NVD.
vulnfeed aggregates 13549 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.