CVE-2026-52724
Received Received - Intake

Authentication Bypass in Kuma Service Mesh

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-52724
EUVD
EUVD-2026-78771

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
kuma kuma to 2.7.26 (exc)
kuma kuma to 2.9.16 (exc)
kuma kuma to 2.11.14 (exc)
kuma kuma to 2.12.11 (exc)
kuma kuma to 2.13.7 (exc)
kumahq kuma 2.7.26
kumahq kuma 2.9.16
kumahq kuma 2.11.14
kumahq kuma 2.12.11
kumahq kuma 2.13.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Kuma service mesh allows an on-path attacker to intercept and impersonate connections between the data plane proxy (kuma-dp) and control plane when no CA certificate is configured. The system disables TLS verification by default in such cases, exposing the dataplane authentication token to interception. Attackers can then inject forged configurations and take over the proxy.

Detection Guidance

Check if kuma-dp is running in Universal mode without a CA certificate configured. Inspect logs for insecure TLS connections or missing certificate verification. Commands: kubectl get pods -n <namespace> (for Kubernetes), ps aux | grep kuma-dp (for VMs), and grep -r 'InsecureSkipVerify' /etc/kuma/ (for config files).

Verify if KUMA_CONTROL_PLANE_CA_CERT is unset and --ca-cert-file is not provided. Check network traffic for unencrypted or intercepted connections between kuma-dp and control plane.

Impact Analysis

An attacker on the same network segment could intercept sensitive authentication tokens, impersonate the control plane, and inject malicious configurations into your service mesh proxies. This could lead to unauthorized access, data breaches, or complete takeover of affected services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. The lack of proper TLS verification undermines data protection measures required by these regulations.

Mitigation Strategies

Upgrade Kuma to versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, or 2.13.7 or later. Explicitly configure CA certificates via --ca-cert-file or KUMA_CONTROL_PLANE_CA_CERT. For Kubernetes, rely on standard installations (kumactl or Helm) which auto-inject CA certificates.

Terminate control plane behind a publicly trusted certificate. Rotate dataplane authentication tokens if they may have been exposed. Monitor for suspicious activity or unauthorized proxy takeovers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart