Go/github.com/kumahq/kuma CVE-2026-18678, CVE-2026-50166: medium 5.5, EPSS 0.13%

kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6010
• nvd: CVE-2026-18678
• https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
• https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
• https://github.com/kumahq/kuma/pull/16777

CVE-2026-18678, CVE-2026-50166 · published 2026-07-22T20:36:55Z · modified 2026-08-13T04:11:05.270163837Z · JSON