Vulnerability Description
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.
Related Weaknesses (CWE)
References
- https://developer.konghq.com/mesh/changelog/
- https://github.com/kumahq/kuma/pull/16777
- https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
FAQ
What is CVE-2026-18678?
CVE-2026-18678 is a documented vulnerability. When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacke...
How severe is CVE-2026-18678?
CVSS scoring is not yet available for CVE-2026-18678. Check NVD for updates.
Is there a patch for CVE-2026-18678?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.