CVE-2026-50166
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In Kuma prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user.
Risk Assessment
Interception of API tokens allows an attacker to act against the control plane with the victim's privileges. The default local profile is unaffected because it uses plain HTTP.
Recommendation
Update Kuma to versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, or 2.13.7, where the issue is fixed.
Other vulnerabilities in Kuma
See all- CVE-2026-52724Medium
In Kuma prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy.
- CVE-2026-18679Medium
When kuma-dp is started against an HTTPS control plane without a CA certificate, TLS peer verification is disabled and the dataplane authentication token is sent over that unverified connection.
- CVE-2026-18678Medium
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.
- CVE-2026-18675Medium
The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid header. A token whose kid is a JSON number decodes as a float64 and triggers a runtime panic before any signature, claims, or authorization check runs.
- CVE-2026-45021Medium
Kuma prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5 has a default kuma-cp config that leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin.
Original NVD description (English source)
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS