{"id":"GHSA-v95x-xhq5-4929","revision":"24c4c4e16c224846b325957df9f27a59","records":[{"revision":"24c4c4e16c224846b325957df9f27a59","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-v95x-xhq5-4929","aliases":["CVE-2026-18678","CVE-2026-50166","GO-2026-6010"],"title":"kumactl connects to control plane without verifying TLS certificate when no CA is configured","description":"When an operator adds an HTTPS control plane profile to `kumactl` without providing a CA certificate, `kumactl` disables TLS verification and sends API tokens over the unverified connection\n\n## Impact\n\nAn attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user\n\n## Affected configurations\n\n- `kumactl` profiles manually added against an HTTPS control plane endpoint without `--ca-cert-file`\n\n## Not affected\n\n- The default local profile, which uses plain HTTP\n\n## Workarounds\n\nWhen adding an HTTPS control plane profile to `kumactl`, always pass `--ca-cert-file` pointing at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration\n\n## Resources\n\n- Fix: https://github.com/kumahq/kuma/pull/16777","state":0,"publishedAt":"2026-07-16T19:12:08+00:00","modifiedAt":"2026-08-13T04:11:05.2701638+00:00","affected":[{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.7.26"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.8.0"},{"kind":"fixed","version":"2.9.16"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.10.0"},{"kind":"fixed","version":"2.11.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.12.0"},{"kind":"fixed","version":"2.12.11"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/kumahq/kuma/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.13.0"},{"kind":"fixed","version":"2.13.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.8.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929","https://github.com/kumahq/kuma/pull/16777","https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a","https://github.com/kumahq/kuma"],"sourceUrl":"https://github.com/advisories/GHSA-v95x-xhq5-4929","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-v95x-xhq5-4929","identifiers":["GHSA-v95x-xhq5-4929","CVE-2026-18678","CVE-2026-50166","GO-2026-6010"]},"retained":false,"historicalAffected":[]}],"coverage":[]}