Go/github.com/kumahq/kuma/v2 CVE-2026-18679, CVE-2026-52724: medium 5.8, EPSS 0.16%
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Action: Upgrade github.com/kumahq/kuma/v2 to 2.7.26 or later.
go get github.com/kumahq/kuma/v2@v2.7.26go get github.com/kumahq/kuma/v2@v2.11.14go get github.com/kumahq/kuma/v2@v2.12.11go get github.com/kumahq/kuma/v2@v2.13.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.26 | - |
| 2.9.13 | 2.11.14 | - |
| 2.12.4 | 2.12.11 | - |
| 2.13.0 | 2.13.7 | - |
Fixed versions
| 2.7.26 | 2.11.14 | 2.12.11 | 2.13.7 |
Sources
- osv: GO-2026-6013#Go/github.com/kumahq/kuma/v2
- nvd: CVE-2026-18679
- https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma/pull/16777
CVE-2026-18679, CVE-2026-52724 · published · modified · JSON