tocsin

Go/github.com/kumahq/kuma/v2 CVE-2026-18678, CVE-2026-50166: medium, EPSS 0.13%

kumactl connects to control plane without verifying TLS certificate when no CA is configured

Action: Upgrade github.com/kumahq/kuma/v2 to 2.7.26 or later.

go get github.com/kumahq/kuma/v2@v2.7.26
go get github.com/kumahq/kuma/v2@v2.9.16
go get github.com/kumahq/kuma/v2@v2.11.14
go get github.com/kumahq/kuma/v2@v2.12.11
go get github.com/kumahq/kuma/v2@v2.13.7

Affected

introducedfixedlast affected
02.7.26-
2.8.02.9.16-
2.10.02.11.14-
2.12.02.12.11-
2.13.02.13.7-

Fixed versions

2.7.262.9.162.11.142.12.112.13.7

Sources

CVE-2026-18678, CVE-2026-50166 · published · modified · JSON