MEDIUMGo
GHSA-v95x-xhq5-4929· CVE-2026-18678, CVE-2026-50166kumactl connects to control plane without verifying TLS certificate when no CA is configured
Modified: 8/13/2026
package
Go/github.com/kumahq/kuma/v2
pkg:go/github.com/kumahq/kuma/v2
MEDIUMGo
GHSA-wvmp-6r4v-j6cv· CVE-2026-18679, CVE-2026-52724kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
Modified: 8/13/2026
—Go
GO-2026-5102· CVE-2026-18676, CVE-2026-45021Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma
Modified: 8/13/2026
—Go
GO-2026-6010· CVE-2026-18678, CVE-2026-50166kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Modified: 8/13/2026
—Go
GO-2026-6013· CVE-2026-18679, CVE-2026-52724kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Modified: 8/13/2026