CVE-2026-18678 json
Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured
published 2026-07-16 3 mo ago modified 2026-10-23 16 d ago also CVE-2026-50166 , GHSA-v95x-xhq5-4929 , GO-2026-6010 , EUVD-2026-57425
- cvss
- 5.5
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.
An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.
Patch / fix
- go github.com/kumahq/kuma/v2 2.7.26, 2.9.16, 2.11.14, 2.12.11, 2.13.7
- Kong Inc. Kong Mesh 2.7.26, 2.9.16, 2.11.14, 2.12.11, 2.13.7
- github.com/kumahq/kuma@2ecadac commit
- github.com/kumahq/kuma#16777 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H |
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/kumahq/kuma/v2 | <2.7.26 >=2.8.0, <2.9.16 >=2.10.0, <2.11.14 >=2.12.0, <2.12.11 >=2.13.0, <2.13.7 >=2.9.13, <2.11.14 >=2.12.4, <2.12.11 |
2.7.26 2.9.16 2.11.14 2.12.11 2.13.7 |
| go | github.com/kumahq/kuma | <=1.8.1 all versions |
no fix listed |
Affected products
- Kong Inc. Kong Mesh
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
github.com
/kumahq/kuma/pull/16777
patch, web
-
github.com
/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
web, patch
-
github.com
/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
vendor-advisory, web, advisory
-
developer.konghq.com
/mesh/changelog/
release-notes
-
github.com
/kumahq/kuma
package
Sources
- CVE List CVE-2026-18678
- GitHub Advisory GHSA-v95x-xhq5-4929
- NVD CVE-2026-18678
- OSV GO-2026-6010
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.