github.com/kumahq/kuma vulnerabilities
CVEs whose affected-version data names the github.com/kumahq/kuma package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-18679Mediumkuma-dp connects to control plane without verifying TLS certificate when no CA is configured
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
▾ Sunlitkumahq · github.com/kumahq/kuma/v2EPSS 0.12%via OSV
CVE-2026-18678Mediumkumactl connects to control plane without verifying TLS certificate when no CA is configured
kumactl connects to control plane without verifying TLS certificate when no CA is configured
▾ Sunlitkumahq · github.com/kumahq/kuma/v2EPSS 0.10%via OSV
CVE-2026-18676MediumDefault kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
▾ Sunlitkumahq · github.com/kumahq/kumaEPSS 0.23%via OSV
CVE-2026-45021MediumDefault kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
▾ Sunlitkumahq · github.com/kumahq/kumaEPSS 0.20%via OSV