Improper Certificate Validation

🗓️ 18 Jul 2026 12:12:21Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 16 Views

Kuma data plane has improper certificate validation; TLS peer verification is off without a certificate authority, enabling a man-in-the-middle to access the dataplane token.

Reporter	Title	Published	Views	Family All 12
CVE	CVE-2026-52724	15 Sep 202614:50	–	cve
Cvelist	CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured	15 Sep 202614:50	–	cvelist
EUVD	EUVD-2026-78771	15 Sep 202614:50	–	euvd
Github Security Blog	kuma-dp connects to control plane without verifying TLS certificate when no CA is configured	16 Jul 202620:09	–	github
NVD	CVE-2026-52724	15 Sep 202615:17	–	nvd
OSV	CVE-2026-18679 Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured	12 Aug 202618:52	–	osv
OSV	GHSA-WVMP-6R4V-J6CV kuma-dp connects to control plane without verifying TLS certificate when no CA is configured	16 Jul 202620:09	–	osv
OSV	GO-2026-6013 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma	22 Jul 202620:36	–	osv
OSV	OPENSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb	30 Jul 202609:09	–	osv
Positive Technologies	PT-2026-60682	16 Jul 202600:00	–	ptsecurity

Vulners

Node

kumahq github.com/kumahq/kumaRange0.1.0–1.8.1go

kumahq github.com/kumahq/kuma/v2Range2.8.0–2.9.15go

kumahq github.com/kumahq/kuma/v2Range2.10.0–2.11.13go

kumahq github.com/kumahq/kuma/v2Range2.12.0–2.12.10go

kumahq github.com/kumahq/kuma/v2Range2.13.0–2.13.6go

kumahq github.com/kumahq/kuma/v2Range2.7.20–2.7.25go

Source	Link
github	www.github.com/kumahq/kuma/pull/16777
github	www.github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
github	www.github.com/advisories/GHSA-wvmp-6r4v-j6cv

06 Aug 2026 20:34Current

5.5Medium risk

Vulners AI Score5.5

EPSS0.00243