CVE-2026-18678CWE-295

CVE-2026-18678

published August 12, 2026

CVSS
5.5
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

The record
Technical detail
CVSS
5.5 · NONE
CVSS v4.0
Not supplied
EPSS
0.00128 · 2.2th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-08-12T23:17Z
References (3)
https://developer.konghq.com/mesh/changelog/ · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/pull/16777 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cbhttps://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
EPSS history
Timeline
  • 12 AUG 18:49Z
    Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured
    cvelistv5