{"id":"CVE-2026-52724","aliases":["CVE-2026-18679","GHSA-wvmp-6r4v-j6cv","GO-2026-6013"],"url":"https://o3.security/vulnerability/CVE-2026-52724","summary":"kuma-dp connects to control plane without verifying TLS certificate when no CA is configured","details":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection\n\n## Impact\n\nAn on-path attacker can intercept the dataplane authentication token and impersonate the control plane to the data plane, allowing them to inject a forged bootstrap configuration and take over the proxy\n\n## Affected configurations\n\n- Universal mode `kuma-dp` started against an HTTPS control plane without `--ca-cert-file` (or `KUMA_CONTROL_PLANE_CA_CERT` unset)\n\n## Not affected\n\n- Kubernetes installs done through the standard installers (`kumactl install control-plane` or the official Helm chart). In both cases the control plane's mutating admission webhook injects `KUMA_CONTROL_PLANE_CA_CERT` into every sidecar at pod admission, so each `kuma-dp` starts with the CA already configured\n\n## Workarounds\n\nSet `--ca-cert-file` (or `KUMA_CONTROL_PLANE_CA_CERT`) on every Universal mode data plane and point it at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration\n\n## Resources\n\n- Fix: https://github.com/kumahq/kuma/pull/16777","published":"2026-09-15T14:50:32.257Z","modified":"2026-10-21T02:58:27.395522288Z","cvss":null,"epss":{"score":0.00243,"percentile":0.15672,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.7.26"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.9.16"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.11.14"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.12.11"},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","fixedVersion":"2.13.7"},{"ecosystem":"Go","name":"github.com/kumahq/kuma","fixedVersion":null}],"fix":{"url":"https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f","label":"kumahq/kuma@2d0fb38"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52724.json"},{"type":"ADVISORY","url":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52724"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980"},{"type":"FIX","url":"https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11"},{"type":"FIX","url":"https://github.com/kumahq/kuma/pull/16777"},{"type":"WEB","url":"https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a"},{"type":"PACKAGE","url":"https://github.com/kumahq/kuma"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:27.395522288Z"}}