MEDIUMGo
GHSA-3vcp-chfh-f6r2· CVE-2026-18676, CVE-2026-45021Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
Modified: 9/10/2026
package
Go/github.com/kumahq/kuma
pkg:go/github.com/kumahq/kuma
HIGH7.5Go
GHSA-9wmc-rg4h-28wvgithub.com/kumahq/kuma affected by CVE-2023-44487
Modified: 10/13/2025
MEDIUMGo
GHSA-v95x-xhq5-4929· CVE-2026-18678, CVE-2026-50166kumactl connects to control plane without verifying TLS certificate when no CA is configured
Modified: 8/13/2026
MEDIUMGo
GHSA-wvmp-6r4v-j6cv· CVE-2026-18679, CVE-2026-52724kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
Modified: 8/13/2026
—Go
GO-2026-5102· CVE-2026-18676, CVE-2026-45021Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma
Modified: 8/13/2026
—Go
GO-2026-6010· CVE-2026-18678, CVE-2026-50166kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Modified: 8/13/2026
—Go
GO-2026-6013· CVE-2026-18679, CVE-2026-52724kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Modified: 8/13/2026