{"id":"CVE-2026-52724","summary":"kuma-dp connects to control plane without verifying TLS certificate when no CA is configured","details":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.","aliases":["CVE-2026-18679","GHSA-wvmp-6r4v-j6cv","GO-2026-6013"],"modified":"2026-09-17T03:46:02.337117390Z","published":"2026-09-15T14:50:32.257Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52724.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-295"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52724.json"},{"type":"ADVISORY","url":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52724"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11"},{"type":"FIX","url":"https://github.com/kumahq/kuma/pull/16777"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kumahq/kuma","events":[{"introduced":"0"},{"introduced":"1110a0305eec00f1b2fd7482d6df4f3dd6a9d78e"},{"introduced":"fed2256136e694d2a5deedb2490d382ee280fbbe"},{"introduced":"6b4779917a9f9f9a73ef959a22e243b9a14b4ba1"},{"introduced":"99bb946e09bcdf7f7e6c1275c8bf14206db77274"},{"fixed":"90c4dfdd7b5b67db087baca61d04ea8a4712ff2e"},{"fixed":"2955869905710384ac686ab651d19953fc85e779"},{"fixed":"00ea5e4a54e2ca09b05d95f73e025d40d6f70c29"},{"fixed":"4bd8f7f6f9ad72b703be5fab2ead97dd09685d6b"},{"fixed":"744bfbb76ce474f568a10a88a6974c2b4db98bcd"},{"fixed":"2d0fb382924598f8746bc85c896f50384675940f"},{"fixed":"85716397ffa404234bf365da0967eca0b0fa1870"},{"fixed":"a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3"},{"fixed":"bb56ae628753aaec1f7846a514ab4edc35c0b569"},{"fixed":"d4ae0c0151596be991897651f20c5cdf32de1980"},{"fixed":"eb81494c2c7a5536e55c19cdde51b02a03b51e11"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.7.26"},{"introduced":"2.8.0"},{"fixed":"2.9.16"},{"introduced":"2.10.0"},{"fixed":"2.11.14"},{"introduced":"2.12.0"},{"fixed":"2.12.11"},{"introduced":"2.13.0"},{"fixed":"2.13.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2.13.6","v2.7.25","2.9.15","v2.12.10","v2.11.13","v2.13.5","2.9.14","v2.7.24","v2.12.9","v2.13.4","v2.11.12","v2.9.13","2.9.13","v2.7.23","v2.11.11","v2.12.8","v2.13.3","v2.7.22","2.9.12","v2.11.10","v2.12.7","v2.13.2","2.9.11","v2.13.1","v2.12.6","v2.11.9","v2.7.21","v2.13.0","v2.12.5","v2.7.20","v2.11.8","v2.12.4","2.12.3","2.11.7","2.7.19","2.12.2","2.12.1","2.9.10","2.11.6","2.7.18","2.12.0","2.11.5","2.9.9","2.7.17","2.9.8","2.11.4","2.7.16","2.9.7","2.7.15","2.11.3","2.11.2","2.11.1","2.9.6","2.7.14","2.11.0","2.7.13","2.9.5","2.7.12","2.9.4","2.9.3","2.7.11","2.9.2","2.7.10","2.9.1","2.7.9","2.9.0","2.7.8","2.7.7","2.7.6","2.7.5","2.7.4","2.7.3","2.7.2","2.7.1","2.7.0","1.5.0-rc1","1.4.0-rc1","1.2.0","1.2.0-rc1","1.0.0-rc2","1.0.0-rc1","080-preview-3","080-preview-2","080-preview-1","0.7.1","0.7.0","0.6.0","0.5.1","0.5.0","0.5.0-rc2","0.5.0-rc1","0.4.0","0.4.0-rc2","0.4.0-rc1","0.3.2","0.3.2-rc2","0.3.1","0.3.0","0.3.0-rc2","0.3.0-rc1","0.2.3-rc4","0.2.2","0.2.2-rc1","0.2.1","0.2.0","0.2.0-rc1","0.1.2","0.1.1","0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52724.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}]}