Go/github.com/kumahq/kuma CVE-2026-18678, CVE-2026-50166: medium, EPSS 0.13%

kumactl connects to control plane without verifying TLS certificate when no CA is configured

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-v95x-xhq5-4929#Go/github.com/kumahq/kuma
• https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
• https://github.com/kumahq/kuma/pull/16777
• https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
• https://github.com/kumahq/kuma

CVE-2026-18678, CVE-2026-50166 · published 2026-07-16T19:12:08Z · modified 2026-08-13T04:11:05.270163837Z · JSON