EUVD-2026-78773
GHSA-v95x-xhq5-4929
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N because MITM can span any network hop; AC:H for required MITM positioning; UI:R because operator must invoke kumactl; C:H and I:H for full token-mediated control plane access; A:N as no availability impact.
Primary rating from Vendor (https://github.com/kumahq/kuma).
CVSS VectorVendor: https://github.com/kumahq/kuma
Lifecycle Timeline
3DescriptionCVE.org
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection
Impact
An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user
Affected configurations
kumactlprofiles manually added against an HTTPS control plane endpoint without--ca-cert-file
Not affected
- The default local profile, which uses plain HTTP
Workarounds
When adding an HTTPS control plane profile to kumactl, always pass --ca-cert-file pointing at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration
Resources
- Fix: https://github.com/kumahq/kuma/pull/16777
AnalysisAI
TLS certificate verification bypass in Kuma's kumactl CLI tool allows network-adjacent attackers to intercept API tokens via man-in-the-middle attack. When an operator adds an HTTPS control plane profile without supplying --ca-cert-file, kumactl silently disables TLS verification (InsecureSkipVerify=true) and transmits API tokens over the unverified connection. A successful intercept grants the attacker the ability to impersonate the operator and issue privileged commands to the control plane. No public exploit identified at time of analysis; vendor-released patches are available.
Technical ContextAI
Kuma (pkg:go/github.com/kumahq/kuma/v2) is a CNCF-hosted universal service mesh built on Envoy. kumactl is its CLI tool for interacting with the control plane API server over HTTPS. The vulnerability is rooted in CWE-295 (Improper Certificate Validation): prior to the fix, the Go TLS client's InsecureSkipVerify flag was set to true whenever no CA certificate was provided, rather than falling back to the operating system trust store. The PR diff confirms this: the old else branch unconditionally set tlsConfig.InsecureSkipVerify = true, while the fix introduces a proper switch that only skips verification when the new --skip-verify opt-in flag is explicitly passed. Bearer API tokens sent over this unauthenticated TLS channel are therefore visible in plaintext to any party capable of positioning themselves on the network path.
RemediationAI
Upgrade to a patched release: 2.7.26, 2.9.16, 2.11.14, or 2.12.11 depending on the active minor branch, as documented in GHSA-v95x-xhq5-4929 (https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929). The patch fix (https://github.com/kumahq/kuma/pull/16777, commit 2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a) changes the default behavior to verify against the OS trust store rather than skip verification, and introduces an explicit --skip-verify flag for intentional bypass in development environments. If upgrading immediately is not possible, apply one of two workarounds: pass --ca-cert-file pointing to the control plane's serving CA every time a new kumactl profile is added (this restores full chain validation at the cost of requiring CA distribution); or terminate the control plane TLS with a certificate issued by a publicly trusted CA already in the OS trust store (eliminates the need for --ca-cert-file entirely). The second workaround has the trade-off of exposing the control plane endpoint to broader certificate trust; the first requires operational discipline to distribute and rotate the CA.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today