CVE-2026-18678 — Vulnerability in github.com/kumahq/kuma/v2 — CVE...

MEDIUM

kumactl connects to control plane without verifying TLS certificate when no CA is configured

Published July 16, 2026Updated August 13, 2026Source: osv

Summary

When an operator adds an HTTPS control plane profile to `kumactl` without providing a CA certificate, `kumactl` disables TLS verification and sends API tokens over the unverified connection ## Impact An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user ## Affected configurations - `kumactl` profiles manually added against an HTTPS control plane endpoint without `--ca-cert-file` ## Not affected - The default local profile, which uses plain HTTP ## Workarounds When adding an HTTPS control plane profile to `kumactl`, always pass `--ca-cert-file` pointing at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration ## Resources - Fix: https://github.com/kumahq/kuma/pull/16777

Advisory Timeline

First published July 16, 2026 (88 days ago).
Last revised August 13, 2026 — 27 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/kumahq/kuma/v2 to 2.11.14 or later

go get github.com/kumahq/kuma/v2@v2.11.14

Update github.com/kumahq/kuma/v2 to 2.13.7 or later

go get github.com/kumahq/kuma/v2@v2.13.7

Update github.com/kumahq/kuma/v2 to 2.12.11 or later

go get github.com/kumahq/kuma/v2@v2.12.11

Update github.com/kumahq/kuma/v2 to 2.7.26 or later

go get github.com/kumahq/kuma/v2@v2.7.26

Update github.com/kumahq/kuma/v2 to 2.9.16 or later

go get github.com/kumahq/kuma/v2@v2.9.16

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (6)

Affects 1 ecosystem: go (2).

Package	Ecosystem	Affected	Fixed In
github.com/kumahq/kuma/v2	go	All versions	2.11.14
github.com/kumahq/kuma/v2	go	All versions	2.13.7
github.com/kumahq/kuma/v2	go	All versions	2.12.11
github.com/kumahq/kuma/v2	go	All versions	2.7.26
github.com/kumahq/kuma/v2	go	All versions	2.9.16
github.com/kumahq/kuma	go	All versions	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-295
Improper Certificate ValidationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.7 score means for each attack dimension.

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

References

Frequently Asked Questions

What is CVE-2026-18678?: kumactl connects to control plane without verifying TLS certificate when no CA is configured This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 7.7/10).
How do I check if my project is affected by CVE-2026-18678?: CVE-2026-18678 affects github.com/kumahq/kuma/v2 and github.com/kumahq/kuma. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-18678 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.7

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-v95x-xhq5-4929

CVE-2026-50166

GO-2026-6010

Related CVEs

CVE-2026-54765
MEDIUM
Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port
CVE-2026-88011
MEDIUM
Traefik: ForwardAuth identity spoofing via dot-form header alias
CVE-2026-18679
MEDIUM
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies