Go/github.com/kumahq/kuma CVE-2026-18679, CVE-2026-52724: medium 5.8, EPSS 0.16%

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-6013
• nvd: CVE-2026-18679
• https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
• https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
• https://github.com/kumahq/kuma/pull/16777

CVE-2026-18679, CVE-2026-52724 · published 2026-07-22T20:36:55Z · modified 2026-08-13T04:10:47.070428214Z · JSON