{"id":"CVE-2026-18678","aliases":["CVE-2026-50166","GHSA-v95x-xhq5-4929","GO-2026-6010"],"url":"https://o3.security/vulnerability/CVE-2026-18678","summary":"Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured","details":"When an operator adds an HTTPS control plane profile to `kumactl` without providing a CA certificate, `kumactl` disables TLS verification and sends API tokens over the unverified connection\n\n## Impact\n\nAn attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user\n\n## Affected configurations\n\n- `kumactl` profiles manually added against an HTTPS control plane endpoint without `--ca-cert-file`\n\n## Not affected\n\n- The default local profile, which uses plain HTTP\n\n## Workarounds\n\nWhen adding an HTTPS control plane profile to `kumactl`, always pass `--ca-cert-file` pointing at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration\n\n## Resources\n\n- Fix: https://github.com/kumahq/kuma/pull/16777","published":"2026-08-12T18:49:45.530Z","modified":"2026-10-28T02:30:27.663204865Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.7.26"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.9.16"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.11.14"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.12.11"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.13.7"},{"ecosystem":"Go","name":"github.com/kumahq/kuma","fixedVersion":null}],"fix":{"url":"https://github.com/kumahq/kuma/pull/16777","label":"kumahq/kuma#16777"},"references":[{"type":"ADVISORY","url":"https://developer.konghq.com/mesh/changelog/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18678.json"},{"type":"ADVISORY","url":"https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18678"},{"type":"FIX","url":"https://github.com/kumahq/kuma/pull/16777"},{"type":"WEB","url":"https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a"},{"type":"PACKAGE","url":"https://github.com/kumahq/kuma"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:27.663204865Z"}}