{"id":"CVE-2026-18679","aliases":["CVE-2026-52724","GHSA-wvmp-6r4v-j6cv","GO-2026-6013"],"url":"https://o3.security/vulnerability/CVE-2026-18679","summary":"Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured","details":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection\n\n## Impact\n\nAn on-path attacker can intercept the dataplane authentication token and impersonate the control plane to the data plane, allowing them to inject a forged bootstrap configuration and take over the proxy\n\n## Affected configurations\n\n- Universal mode `kuma-dp` started against an HTTPS control plane without `--ca-cert-file` (or `KUMA_CONTROL_PLANE_CA_CERT` unset)\n\n## Not affected\n\n- Kubernetes installs done through the standard installers (`kumactl install control-plane` or the official Helm chart). In both cases the control plane's mutating admission webhook injects `KUMA_CONTROL_PLANE_CA_CERT` into every sidecar at pod admission, so each `kuma-dp` starts with the CA already configured\n\n## Workarounds\n\nSet `--ca-cert-file` (or `KUMA_CONTROL_PLANE_CA_CERT`) on every Universal mode data plane and point it at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration\n\n## Resources\n\n- Fix: https://github.com/kumahq/kuma/pull/16777","published":"2026-08-12T18:52:31.146Z","modified":"2026-10-21T02:56:17.874236678Z","cvss":null,"epss":{"score":0.00119,"percentile":0.02009,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.7.26"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.9.16"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.11.14"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.12.11"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.13.7"},{"ecosystem":"Go","name":"github.com/kumahq/kuma","fixedVersion":null}],"fix":{"url":"https://github.com/kumahq/kuma/pull/16777","label":"kumahq/kuma#16777"},"references":[{"type":"ADVISORY","url":"https://developer.konghq.com/mesh/changelog/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18679.json"},{"type":"ADVISORY","url":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18679"},{"type":"FIX","url":"https://github.com/kumahq/kuma/pull/16777"},{"type":"WEB","url":"https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a"},{"type":"PACKAGE","url":"https://github.com/kumahq/kuma"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:56:17.874236678Z"}}