CVE-2026-18678

Published: Ago 12, 2026 Last Modified: Ago 12, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,5
Source: 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
Attack Vector: adjacent
Attack Complexity: high
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

295

Improper Certificate Validation

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Authentication
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity
Applicable Platforms
Technologies: Not Technology-Specific, Web Based, Mobile
View CWE Details
https://developer.konghq.com/mesh/changelog/
https://developer.konghq.com/mesh/changelog/
https://github.com/kumahq/kuma/pull/16777
https://github.com/kumahq/kuma/pull/16777
https://github.com/kumahq/kuma/security/advisories/GHSA-v95…
https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929