{"id":"CVE-2026-50166","aliases":["CVE-2026-18678","GHSA-v95x-xhq5-4929","GO-2026-6010"],"url":"https://o3.security/vulnerability/CVE-2026-50166","summary":"Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured","details":"When an operator adds an HTTPS control plane profile to `kumactl` without providing a CA certificate, `kumactl` disables TLS verification and sends API tokens over the unverified connection\n\n## Impact\n\nAn attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user\n\n## Affected configurations\n\n- `kumactl` profiles manually added against an HTTPS control plane endpoint without `--ca-cert-file`\n\n## Not affected\n\n- The default local profile, which uses plain HTTP\n\n## Workarounds\n\nWhen adding an HTTPS control plane profile to `kumactl`, always pass `--ca-cert-file` pointing at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration\n\n## Resources\n\n- Fix: https://github.com/kumahq/kuma/pull/16777","published":"2026-09-15T14:52:30.085Z","modified":"2026-10-21T02:58:24.743885629Z","cvss":null,"epss":{"score":0.00185,"percentile":0.08351,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.7.26"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.9.16"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.11.14"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.12.11"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.13.7"},{"ecosystem":"Go","name":"github.com/kumahq/kuma","fixedVersion":null}],"fix":{"url":"https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f","label":"kumahq/kuma@2d0fb38"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50166.json"},{"type":"ADVISORY","url":"https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50166"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11"},{"type":"FIX","url":"https://github.com/kumahq/kuma/pull/16777"},{"type":"WEB","url":"https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a"},{"type":"PACKAGE","url":"https://github.com/kumahq/kuma"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:24.743885629Z"}}