Kuma kuma-dp CVE-2026-52724
MEDIUM
GHSA-wvmp-6r4v-j6cv
Severity by source
On-path MitM requires AC:H; no auth needed for attacker (PR:N); proxy takeover impacts services beyond the vulnerable component (S:C) with full C/I/A.
Lifecycle Timeline
2DescriptionCVE.org
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection
Impact
An on-path attacker can intercept the dataplane authentication token and impersonate the control plane to the data plane, allowing them to inject a forged bootstrap configuration and take over the proxy
Affected configurations
- Universal mode
kuma-dpstarted against an HTTPS control plane without--ca-cert-file(orKUMA_CONTROL_PLANE_CA_CERTunset)
Not affected
- Kubernetes installs done through the standard installers (
kumactl install control-planeor the official Helm chart). In both cases the control plane's mutating admission webhook injectsKUMA_CONTROL_PLANE_CA_CERTinto every sidecar at pod admission, so eachkuma-dpstarts with the CA already configured
Workarounds
Set --ca-cert-file (or KUMA_CONTROL_PLANE_CA_CERT) on every Universal mode data plane and point it at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration
Resources
- Fix: https://github.com/kumahq/kuma/pull/16777
AnalysisAI
TLS certificate verification bypass in Kuma's kuma-dp data plane allows an on-path attacker to intercept the dataplane authentication token and inject a forged bootstrap configuration, effectively taking over the proxy. Affected deployments are Universal mode installations where operators start kuma-dp against an HTTPS control plane without supplying a CA certificate via --ca-cert-file or the KUMA_CONTROL_PLANE_CA_CERT environment variable. Standard Kubernetes installations using kumactl or the official Helm chart are not affected because the mutating admission webhook automatically injects the CA certificate. No public exploit or CISA KEV listing is present at time of analysis; patch releases are available across all supported branches.
Technical ContextAI
Kuma is a CNCF-hosted service mesh built on Envoy, with a Go-based data plane binary (kuma-dp) that fetches its Envoy bootstrap configuration from a central control plane over HTTPS. CWE-295 (Improper Certificate Validation) describes the root cause: the pre-patch code in app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap.go unconditionally set tlsConfig.InsecureSkipVerify = true whenever the operator omitted the CaCert field, with only a log warning as a deterrent. The dataplane authentication token was then transmitted over this unverified TLS connection. The affected packages are identified via PURL as pkg:go/github.com_kumahq_kuma_v2 across four vulnerable version ranges, plus the legacy pkg:go/github.com_kumahq_kuma. The PR diff confirms the fix converts the conditional from a simple if/else on CaCert presence to a three-branch switch: explicit --skip-verify flag (development only), CA cert provided, or fall through to OS trust store verification - eliminating the silent InsecureSkipVerify default.
RemediationAI
Upgrade kuma-dp to one of the vendor-released patched versions: 2.7.26 (for 2.7.x branch), 2.9.16 (for 2.8.x/2.9.x branch), 2.11.14 (for 2.10.x/2.11.x branch), or 2.12.11 (for 2.12.x branch), per the GitHub security advisory at https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv. The fix is tracked in PR https://github.com/kumahq/kuma/pull/16777 and commit 2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a. For deployments that cannot be patched immediately, the primary workaround is to supply the control plane's serving CA to every Universal mode data plane by setting --ca-cert-file or the KUMA_CONTROL_PLANE_CA_CERT environment variable - this restores TLS peer verification without requiring a software update and eliminates the vulnerability entirely. As an alternative workaround, terminating the control plane behind a certificate issued by a publicly trusted CA allows the patched kuma-dp to verify against the OS trust store with no further configuration; however, this does not protect unpatched kuma-dp instances. Do not rely on the log warning emitted by the old code as a security control.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today