EUVD-2026-57425
GHSA-26pg-x7g5-9g43
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only attacker access and MitM requirement justify AV:A/AC:H; no attacker privileges needed; operator must run a command (UI:R); token theft affects separate control plane system (S:C).
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
Lifecycle Timeline
2DescriptionCVE.org
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.
An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.
AnalysisAI
TLS certificate verification is silently disabled in the kumactl CLI (Kong Mesh / Kuma) when an operator registers an HTTPS control plane profile without specifying a CA certificate via --ca-cert-file, causing API tokens to traverse the connection without server identity validation. A network-adjacent attacker capable of intercepting traffic between the operator's workstation and the control plane can steal user or administrator API tokens and subsequently issue arbitrary authenticated commands against the control plane. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the operator has added a control plane profile to kumactl targeting an HTTPS endpoint without supplying --ca-cert-file, causing kumactl to silently disable certificate verification for that profile; and (2) the attacker is positioned on the network path between the operator's host and the control plane, capable of intercepting or proxying TCP connections. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:P) accurately reflects that exploitation requires an attacker to achieve a network-path position between the operator and control plane - a meaningful barrier - plus the specific misconfiguration of an HTTPS profile without a CA cert (AT:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to a patched release: 2.7.26 (for the 2.7.x line), 2.9.16 (for 2.8.x/2.9.x), 2.11.14 (for 2.10.x/2.11.x), or 2.12.11 (for 2.12.x). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-zone isolation is broken in Kong Mesh's global control plane, allowing any authenticated zone to inject and overwr
SPIFFE identity impersonation in Kong Mesh universal mode allows an authenticated dataplane operator to assume another w
TLS certificate verification bypass in Kong Mesh's kuma-dp data plane component exposes authentication tokens to on-path
Unauthenticated exposure of Envoy admin data in kuma-dp (Kong Mesh data plane) allows any pod on the Kubernetes cluster
Denial-of-service in Kong Mesh's kuma-cp control plane allows unauthenticated network-adjacent attackers to crash the en
Kong Mesh's control plane (kuma-cp) exposes the admin bootstrap token and JWT signing keys to any malicious webpage visi
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today