CVE-2026-18678

Published: Aug 12, 2026Modified: Aug 31, 2026

5.5

Vector

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb (Secondary)

Description

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (3)

https://developer.konghq.com/mesh/changelog/

Source: 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb

https://github.com/kumahq/kuma/pull/16777

Source: 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb

https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929

Source: 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb

Timeline

No history available yet.