CVE-2026-52724

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

MEDIUM

5.8

CVSS Score

Published: September 15, 2026 at 02:50 PM UTC

Updated: September 30, 2026 at 05:43 PM UTC

1 product affected across 1 vendorKuma

Using kuma by kumahq?

Get instant alerts when new vulnerabilities affect kuma - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.8

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Kuma · Kumahq

60%

v < 2.11.14v < 2.12.11v < 2.13.7v < 2.7.26v < 2.9.16

Affected range stops below 2.11.14, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.12.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.13.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.7.26, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.9.16, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

x_refsource_CONFIRM

Source: cverecord

https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv

x_refsource_MISC

Source: cverecord

https://github.com/kumahq/kuma/pull/16777

x_refsource_MISC

Source: cverecord

https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f

x_refsource_MISC

Source: cverecord

https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870

x_refsource_MISC

Source: cverecord

https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3

x_refsource_MISC

Source: cverecord

https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569

x_refsource_MISC

Source: cverecord

https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980

x_refsource_MISC

Source: cverecord

https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.8MEDIUMGitHub_M

Vector?

Quick Info

StatusAWAITING ANALYSIS

CWE

CWE-295

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card