MEDIUMGo
GHSA-v95x-xhq5-4929· CVE-2026-18678, CVE-2026-50166kumactl connects to control plane without verifying TLS certificate when no CA is configured
Modified: 8/13/2026
package
pkg:go/github.com/kumahq/kuma/v2
kumactl connects to control plane without verifying TLS certificate when no CA is configured
Modified: 8/13/2026
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
Modified: 8/13/2026
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma
Modified: 8/13/2026
kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Modified: 8/13/2026
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Modified: 8/13/2026