CVE-2026-52724
MediumCVSS 5.8Summary
In Kuma prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy.
Risk Assessment
An on-path attacker can take over the proxy and inject a forged configuration. Standard Kubernetes installations created by kumactl or the official Helm chart are unaffected because the webhook injects KUMA_CONTROL_PLANE_CA_CERT.
Recommendation
Update Kuma to versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, or 2.13.7, where the issue is fixed.
Other vulnerabilities in Kuma
See all- CVE-2026-50166Medium
In Kuma prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user.
- CVE-2026-18679Medium
When kuma-dp is started against an HTTPS control plane without a CA certificate, TLS peer verification is disabled and the dataplane authentication token is sent over that unverified connection.
- CVE-2026-18678Medium
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.
- CVE-2026-18675Medium
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.
Original NVD description (English source)
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS