{"id":"EUVD-2026-57427","enisaUuid":"fb21ff00-82ea-3138-b43d-e8c9bca48784","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","datePublished":"Aug 12, 2026, 6:52:31 PM","dateUpdated":"Aug 13, 2026, 2:45:35 PM","baseScore":5.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","references":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv\nhttps://github.com/kumahq/kuma/pull/16777\nhttps://developer.konghq.com/mesh/changelog/\n","aliases":"CVE-2026-18679\nGHSA-wc82-hqx6-g35q\n","assigner":"Kong","epss":0.16,"enisaIdProduct":[{"id":"55483df9-870a-3e67-840a-6e2f9b245ba6","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"2.13.0 \u003c2.13.7"},{"id":"79fb1edc-fdc6-3f56-a136-31ac3b55530d","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"2.8.0 \u003c2.9.16"},{"id":"c74b6989-411d-341a-8a97-8350a1a79032","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"2.10.0 \u003c2.11.14"},{"id":"c89e7961-a4c3-3bc6-ac63-69854e646c35","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"2.12.0 \u003c2.12.11"},{"id":"fb4c28db-9a62-32f9-b01f-8d94a2e24d83","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"0 \u003c2.7.26"}],"enisaIdVendor":[{"id":"2de5c291-d6dd-3253-bb6c-8304ac81e4a7","vendor":{"name":"Kong Inc."}}],"enisaIdVulnerability":[{"id":"5d386a27-a00d-3ae2-b30f-8f902453f77c","vulnerability":{"id":"GHSA-wc82-hqx6-g35q","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","datePublished":"Aug 12, 2026, 9:31:40 PM","dateUpdated":"Aug 12, 2026, 9:31:40 PM","baseScore":0.0,"references":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-18679\nhttps://github.com/kumahq/kuma/pull/16777\nhttps://developer.konghq.com/mesh/changelog\n","enisa_id":"EUVD-2026-57427\n","aliases":"CVE-2026-18679\nGHSA-wc82-hqx6-g35q\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dd3989d1-a75e-3a3b-b02f-642077f42c5b","vulnerability":{"id":"CVE-2026-18679","description":"When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.","datePublished":"Aug 12, 2026, 6:52:31 PM","dateUpdated":"Aug 13, 2026, 2:45:35 PM","status":"PUBLISHED","baseScore":5.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","references":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv\nhttps://github.com/kumahq/kuma/pull/16777\nhttps://developer.konghq.com/mesh/changelog/\n","enisa_id":"EUVD-2026-57427\n","assigner":"Kong","epss":0.16,"dataProcessed":"Nov 4, 2026, 7:19:59 AM","vulnerabilityProduct":[{"id":"0a6081bb-1914-3604-91c0-547f632e41b0","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"2.8.0 \u003c2.9.16"},{"id":"3513a609-bec7-3f6c-998d-63244c633cb2","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"0 \u003c2.7.26"},{"id":"51b12f04-b618-3ebe-8fbf-ae24782e8d9e","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"2.10.0 \u003c2.11.14"},{"id":"6625feeb-2712-3618-97c8-4bab62a1e475","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"2.13.0 \u003c2.13.7"},{"id":"f2a2bad7-37ba-3179-a1a6-456e5b9115e9","product":{"name":"Kong Mesh","vendor":{"name":"Kong Inc."}},"product_version":"2.12.0 \u003c2.12.11"}],"vulnerabilityVendor":[{"id":"213301f6-fdfc-30cf-b776-476fab51b3b5","vendor":{"name":"Kong Inc."}}]}}],"enisaIdAdvisory":[]}