CVE-2026-18678

EUVD-2026-57425
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.



An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://developer.konghq.com/mesh/changelog/
https://github.com/kumahq/kuma/pull/16777
https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929