CVE-2026-18679
4 advisories.
Go/github.com/kumahq/kuma/v2 CVE-2026-18679, CVE-2026-52724: medium
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
Action: Upgrade github.com/kumahq/kuma/v2 to 2.7.26 or later.
go get github.com/kumahq/kuma/v2@v2.7.26go get github.com/kumahq/kuma/v2@v2.9.16go get github.com/kumahq/kuma/v2@v2.11.14go get github.com/kumahq/kuma/v2@v2.12.11go get github.com/kumahq/kuma/v2@v2.13.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.26 | - |
| 2.8.0 | 2.9.16 | - |
| 2.10.0 | 2.11.14 | - |
| 2.12.0 | 2.12.11 | - |
| 2.13.0 | 2.13.7 | - |
Fixed versions
| 2.7.26 | 2.9.16 | 2.11.14 | 2.12.11 | 2.13.7 |
Sources
- osv: GHSA-wvmp-6r4v-j6cv
- https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
- https://github.com/kumahq/kuma/pull/16777
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma
CVE-2026-18679, CVE-2026-52724 · published · modified · JSON
Go/github.com/kumahq/kuma CVE-2026-18679, CVE-2026-52724: medium
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.8.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-wvmp-6r4v-j6cv#Go/github.com/kumahq/kuma
- https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
- https://github.com/kumahq/kuma/pull/16777
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma
CVE-2026-18679, CVE-2026-52724 · published · modified · JSON
Go/github.com/kumahq/kuma CVE-2026-18679, CVE-2026-52724: unknown
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2026-6013
- https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma/pull/16777
CVE-2026-18679, CVE-2026-52724 · published · modified · JSON
Go/github.com/kumahq/kuma/v2 CVE-2026-18679, CVE-2026-52724: unknown
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Action: Upgrade github.com/kumahq/kuma/v2 to 2.7.26 or later.
go get github.com/kumahq/kuma/v2@v2.7.26go get github.com/kumahq/kuma/v2@v2.11.14go get github.com/kumahq/kuma/v2@v2.12.11go get github.com/kumahq/kuma/v2@v2.13.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.26 | - |
| 2.9.13 | 2.11.14 | - |
| 2.12.4 | 2.12.11 | - |
| 2.13.0 | 2.13.7 | - |
Fixed versions
| 2.7.26 | 2.11.14 | 2.12.11 | 2.13.7 |
Sources
- osv: GO-2026-6013#Go/github.com/kumahq/kuma/v2
- https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma/pull/16777
CVE-2026-18679, CVE-2026-52724 · published · modified · JSON