CVE-2026-18679
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
When kuma-dp is started against an HTTPS control plane without a CA certificate, TLS peer verification is disabled and the dataplane authentication token is sent over that unverified connection.
Risk Assessment
An on-path attacker can intercept the token and impersonate the control plane, injecting a forged bootstrap configuration and taking over the proxy.
Recommendation
Always provide a CA certificate when configuring kuma-dp for HTTPS control planes.
Other vulnerabilities in Kuma
See all- CVE-2026-52724Medium
In Kuma prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy.
- CVE-2026-50166Medium
In Kuma prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user.
- CVE-2026-18678Medium
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.
- CVE-2026-18675Medium
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.
Original NVD description (English source)
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS