CVE-2026-18678

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

CVSS

No CVSS.

References

Link	Resource
https://developer.konghq.com/mesh/changelog/
https://github.com/kumahq/kuma/pull/16777
https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Cuyo un operador añade un perfil de plano de control HTTPS a kumactl sin proporcionar un certificado de CA, kumactl deshabilita la verificación TLS y envía tokens de API a través de la conexión no verificada. Un atacante en la ruta de red entre el operador y el plano de control puede interceptar tokens de API de usuario o de administrador y luego actuar contra el plano de control como ese usuario.

Information

Published : 2026-08-12 19:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-18678

Mitre link : CVE-2026-18678

CVE.ORG link : CVE-2026-18678

JSON object : View

Products Affected

No product.

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-18678", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18678", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T14:47:28.559922Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "affectedData": [{"vendor": "Kong Inc.", "modules": ["kumactl"], "product": "Kong Mesh", "versions": [{"status": "affected", "version": "0", "lessThan": "2.7.26", "versionType": "semver"}, {"status": "affected", "version": "2.8.0", "lessThan": "2.9.16", "versionType": "semver"}, {"status": "affected", "version": "2.10.0", "lessThan": "2.11.14", "versionType": "semver"}, {"status": "affected", "version": "2.12.0", "lessThan": "2.12.11", "versionType": "semver"}, {"status": "affected", "version": "2.13.0", "lessThan": "2.13.7", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T19:17:31.323", "references": [{"url": "https://developer.konghq.com/mesh/changelog/", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}, {"url": "https://github.com/kumahq/kuma/pull/16777", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}, {"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.\n\n\n\nAn attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user."}, {"lang": "es", "value": "Cuyo un operador a\u00f1ade un perfil de plano de control HTTPS a kumactl sin proporcionar un certificado de CA, kumactl deshabilita la verificaci\u00f3n TLS y env\u00eda tokens de API a trav\u00e9s de la conexi\u00f3n no verificada.\n\nUn atacante en la ruta de red entre el operador y el plano de control puede interceptar tokens de API de usuario o de administrador y luego actuar contra el plano de control como ese usuario."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}