Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-18679 · Microsoft / collected KEV context

CVE-2026-52724 · Microsoft / collected KEV context

EUVD-2026-57427

GHSA-wc82-hqx6-g35q

EUVD-2026-78771

GHSA-wvmp-6r4v-j6cv

GO-2026-6013

cve-program · CVE-2026-18679

• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
• https://github.com/kumahq/kuma/pull/16777
• https://developer.konghq.com/mesh/changelog/

cve-program · CVE-2026-52724

• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
• https://github.com/kumahq/kuma/pull/16777
• https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f
• https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870
• https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3
• https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569
• https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980
• https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11

euvd · EUVD-2026-57427

• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
• https://github.com/kumahq/kuma/pull/16777
• https://developer.konghq.com/mesh/changelog/

euvd · EUVD-2026-78771

• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
• https://github.com/kumahq/kuma/pull/16777
• https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f
• https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870
• https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3
• https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569
• https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980
• https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11

nvd · CVE-2026-18679

• https://developer.konghq.com/mesh/changelog/
• https://github.com/kumahq/kuma/pull/16777
• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv

nvd · CVE-2026-52724

• https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f
• https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870
• https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3
• https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569
• https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980
• https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11
• https://github.com/kumahq/kuma/pull/16777
• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv

osv · GHSA-wvmp-6r4v-j6cv

• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
• https://github.com/kumahq/kuma/pull/16777
• https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
• https://github.com/kumahq/kuma

osv · GO-2026-6013

• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
• https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
• https://github.com/kumahq/kuma/pull/16777

No related operational record is retained in the current change model.