CVE-2026-50166
4 advisories.
Go/github.com/kumahq/kuma/v2 CVE-2026-18678, CVE-2026-50166: medium, EPSS 0.13%
kumactl connects to control plane without verifying TLS certificate when no CA is configured
Action: Upgrade github.com/kumahq/kuma/v2 to 2.7.26 or later.
go get github.com/kumahq/kuma/v2@v2.7.26go get github.com/kumahq/kuma/v2@v2.9.16go get github.com/kumahq/kuma/v2@v2.11.14go get github.com/kumahq/kuma/v2@v2.12.11go get github.com/kumahq/kuma/v2@v2.13.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.26 | - |
| 2.8.0 | 2.9.16 | - |
| 2.10.0 | 2.11.14 | - |
| 2.12.0 | 2.12.11 | - |
| 2.13.0 | 2.13.7 | - |
Fixed versions
| 2.7.26 | 2.9.16 | 2.11.14 | 2.12.11 | 2.13.7 |
Sources
- osv: GHSA-v95x-xhq5-4929
- https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
- https://github.com/kumahq/kuma/pull/16777
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma
CVE-2026-18678, CVE-2026-50166 · published · modified · JSON
Go/github.com/kumahq/kuma CVE-2026-18678, CVE-2026-50166: medium, EPSS 0.13%
kumactl connects to control plane without verifying TLS certificate when no CA is configured
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.8.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-v95x-xhq5-4929#Go/github.com/kumahq/kuma
- https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
- https://github.com/kumahq/kuma/pull/16777
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma
CVE-2026-18678, CVE-2026-50166 · published · modified · JSON
Go/github.com/kumahq/kuma CVE-2026-18678, CVE-2026-50166: unknown, EPSS 0.13%
kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2026-6010
- https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma/pull/16777
CVE-2026-18678, CVE-2026-50166 · published · modified · JSON
Go/github.com/kumahq/kuma/v2 CVE-2026-18678, CVE-2026-50166: unknown, EPSS 0.13%
kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma
Action: Upgrade github.com/kumahq/kuma/v2 to 2.7.26 or later.
go get github.com/kumahq/kuma/v2@v2.7.26go get github.com/kumahq/kuma/v2@v2.11.14go get github.com/kumahq/kuma/v2@v2.12.11go get github.com/kumahq/kuma/v2@v2.13.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.26 | - |
| 2.9.13 | 2.11.14 | - |
| 2.12.4 | 2.12.11 | - |
| 2.13.0 | 2.13.7 | - |
Fixed versions
| 2.7.26 | 2.11.14 | 2.12.11 | 2.13.7 |
Sources
- osv: GO-2026-6010#Go/github.com/kumahq/kuma/v2
- https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
- https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
- https://github.com/kumahq/kuma/pull/16777
CVE-2026-18678, CVE-2026-50166 · published · modified · JSON