{"id":"CVE-2026-52724","title":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs","summary":"Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer ve…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","cwe":["CWE-295"],"vendor":"kumahq","product":"kuma","affected":["kuma < 2.7.26","kuma >= 2.8.0, < 2.9.16","kuma >= 2.10.0, < 2.11.14","kuma >= 2.12.0, < 2.12.11","kuma >= 2.13.0, < 2.13.7"],"patched":["github.com/kumahq/kuma/v2 2.7.26","github.com/kumahq/kuma/v2 2.9.16","github.com/kumahq/kuma/v2 2.11.14","github.com/kumahq/kuma/v2 2.12.11","github.com/kumahq/kuma/v2 2.13.7"],"published":"2026-09-15","updated":"2026-09-15","sourceUpdated":"2026-09-15T16:17:12.540","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52724","references":[{"url":"https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f","label":"security-advisories@github.com"},{"url":"https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870","label":"security-advisories@github.com"},{"url":"https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3","label":"security-advisories@github.com"},{"url":"https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569","label":"security-advisories@github.com"},{"url":"https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980","label":"security-advisories@github.com"},{"url":"https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11","label":"security-advisories@github.com"},{"url":"https://github.com/kumahq/kuma/pull/16777","label":"security-advisories@github.com"},{"url":"https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv","label":"security-advisories@github.com"},{"url":"https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a"},{"url":"https://github.com/advisories/GHSA-wvmp-6r4v-j6cv"}],"tags":["nvd","cve.org","ghsa","go"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-15T15:20:22.070620Z"},"cvssSource":"cna","aliases":["GHSA-wvmp-6r4v-j6cv"],"ecosystem":"go","ingestedAt":"2026-07-16T20:58:02.863Z","epss":0.0035,"epssPercentile":0.2596,"slug":"CVE-2026-52724","body":"## Overview\n\nKuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-52724)\n\nAffected packages:\n\n- `github.com/kumahq/kuma/v2 < 2.7.26`\n- `github.com/kumahq/kuma/v2 >= 2.8.0, < 2.9.16`\n- `github.com/kumahq/kuma/v2 >= 2.10.0, < 2.11.14`\n- `github.com/kumahq/kuma/v2 >= 2.12.0, < 2.12.11`\n- `github.com/kumahq/kuma/v2 >= 2.13.0, < 2.13.7`\n- `github.com/kumahq/kuma <= 1.8.1`\n\nPatched in:\n\n- `github.com/kumahq/kuma/v2 2.7.26`\n- `github.com/kumahq/kuma/v2 2.9.16`\n- `github.com/kumahq/kuma/v2 2.11.14`\n- `github.com/kumahq/kuma/v2 2.12.11`\n- `github.com/kumahq/kuma/v2 2.13.7`\n\nSource: https://github.com/advisories/GHSA-wvmp-6r4v-j6cv","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":203806,"id":"CVE-2026-52724","ts":1789486793737,"field":"cvss","old":null,"new":"5.8"}]}