Go/github.com/kumahq/kuma/v2 CVE-2026-18678, CVE-2026-50166: medium 5.5, EPSS 0.13%
kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Action: Upgrade github.com/kumahq/kuma/v2 to 2.7.26 or later.
go get github.com/kumahq/kuma/v2@v2.7.26go get github.com/kumahq/kuma/v2@v2.11.14go get github.com/kumahq/kuma/v2@v2.12.11go get github.com/kumahq/kuma/v2@v2.13.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.26 | - |
| 2.9.13 | 2.11.14 | - |
| 2.12.4 | 2.12.11 | - |
| 2.13.0 | 2.13.7 | - |
Fixed versions
| 2.7.26 | 2.11.14 | 2.12.11 | 2.13.7 |
Sources
- osv: GO-2026-6010#Go/github.com/kumahq/kuma/v2
- nvd: CVE-2026-18678
- https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma/pull/16777
CVE-2026-18678, CVE-2026-50166 · published · modified · JSON