{"id":"EUVD-2026-78771","enisaUuid":"bf94a2f9-116b-3fc2-9a63-dcb057509919","description":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.","datePublished":"Sep 15, 2026, 2:50:32 PM","dateUpdated":"Sep 15, 2026, 3:21:20 PM","baseScore":5.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","references":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv\nhttps://github.com/kumahq/kuma/pull/16777\nhttps://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f\nhttps://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870\nhttps://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3\nhttps://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569\nhttps://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980\nhttps://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11\n","aliases":"CVE-2026-52724\nGHSA-wvmp-6r4v-j6cv\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"41b30af3-137d-3868-afed-9bac308c6f8b","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.8.0, \u003c 2.9.16"},{"id":"4aeba998-92a8-335b-9242-d353ba68eecb","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.12.0, \u003c 2.12.11"},{"id":"5cc619b6-e13a-37bb-8783-7a61ddd99938","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.10.0, \u003c 2.11.14"},{"id":"e17017d2-60b4-32bf-9c33-5ceb91b7dc35","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"\u003c 2.7.26"},{"id":"f86bffb7-954a-3984-9f12-70ed3e65417a","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.13.0, \u003c 2.13.7"}],"enisaIdVendor":[{"id":"a656ca54-66fb-3ac0-81aa-ac84a8f38a67","vendor":{"name":"kumahq"}}],"enisaIdVulnerability":[{"id":"25f741eb-9edb-3f88-bf98-d9605c91fd59","vulnerability":{"id":"GHSA-wvmp-6r4v-j6cv","description":"kuma-dp connects to control plane without verifying TLS certificate when no CA is configured","datePublished":"Jul 16, 2026, 8:09:12 PM","dateUpdated":"Jul 16, 2026, 8:09:12 PM","baseScore":0.0,"references":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv\nhttps://github.com/kumahq/kuma/pull/16777\nhttps://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a\nhttps://github.com/kumahq/kuma\n","enisa_id":"EUVD-2026-78771\n","aliases":"CVE-2026-52724\nGHSA-wvmp-6r4v-j6cv\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f6fffc68-fc0f-398d-bcb0-8aecc67c4ac3","vulnerability":{"id":"CVE-2026-52724","description":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.","datePublished":"Sep 15, 2026, 2:50:32 PM","dateUpdated":"Sep 15, 2026, 3:21:20 PM","status":"PUBLISHED","baseScore":5.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","references":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv\nhttps://github.com/kumahq/kuma/pull/16777\nhttps://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f\nhttps://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870\nhttps://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3\nhttps://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569\nhttps://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980\nhttps://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11\n","enisa_id":"EUVD-2026-78771\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 30, 2026, 7:16:05 AM","vulnerabilityProduct":[{"id":"01295240-b002-3f56-b246-4c4c34f86844","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.8.0, \u003c 2.9.16"},{"id":"4ce9bcfa-487b-3482-84f0-38e3cbd1abd5","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.10.0, \u003c 2.11.14"},{"id":"8654f1ce-c601-347c-8b94-20a6dace1e41","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.13.0, \u003c 2.13.7"},{"id":"9f73875c-d878-3fcd-8c72-257b52e95f1c","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"\u003c 2.7.26"},{"id":"f78d856d-bc25-3948-9582-1100ce39660a","product":{"name":"kuma","vendor":{"name":"kumahq"}},"product_version":"2.12.0, \u003c 2.12.11"}],"vulnerabilityVendor":[{"id":"49f332f4-5d37-3c95-a5f6-d3a73d34ba9a","vendor":{"name":"kumahq"}}]}}],"enisaIdAdvisory":[]}