Go/github.com/kumahq/kuma CVE-2026-18679, CVE-2026-52724: medium, EPSS 0.16%

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-wvmp-6r4v-j6cv#Go/github.com/kumahq/kuma
• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
• https://github.com/kumahq/kuma/pull/16777
• https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
• https://github.com/kumahq/kuma

CVE-2026-18679, CVE-2026-52724 · published 2026-07-16T20:09:12Z · modified 2026-08-13T04:10:47.070428214Z · JSON