CVE-2026-18679

Awaiting Analysis Awaiting Analysis - Queue

kuma-dp Data Plane Authentication Token Exposure via TLS Downgrade

Publication date: 2026-08-12

Last updated on: 2026-08-31

Assigner: Kong

Description

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-31

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18679

EUVD

EUVD-2026-57427

Affected Vendors & Products

Vendor	Product	Version / Range
kumahq	kuma	to 2026-18678 (inc)
kumahq	kuma-dp	to 2026-52724 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in kuma-dp when it connects to an HTTPS control plane without a CA certificate. The system disables TLS peer verification, allowing an on-path attacker to intercept the dataplane authentication token. The attacker can then impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy.

Detection Guidance

Check if kuma-dp is running without a CA certificate configured by inspecting process arguments or environment variables for missing --ca-cert-file or KUMA_CONTROL_PLANE_CA_CERT. Monitor network traffic for unencrypted or unverified TLS connections to the control plane.

Impact Analysis

An attacker could intercept sensitive authentication tokens and gain control over the proxy, leading to potential data breaches or unauthorized access to network traffic. This is especially risky in Universal mode deployments where CA certificates are not explicitly configured.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data transmitted between the data plane and control plane, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. The lack of TLS verification allows interception of authentication tokens and forged configurations, compromising data confidentiality and integrity.

Mitigation Strategies

Explicitly configure the CA certificate on every Universal mode data plane using --ca-cert-file or KUMA_CONTROL_PLANE_CA_CERT. Alternatively, terminate the control plane behind a publicly trusted certificate for verification against the OS trust store.

Hi! I’m here to help you understand CVE-2026-18679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70