PT-2026-60681 · Kumahq · Kuma

CVE-2026-50166 · Published 2026-07-16 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions github.com/kumahq/kuma/v2 versions 2.8.0 through 2.9.15

Description When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, the tool disables TLS verification. This causes API tokens to be transmitted over an unverified connection, allowing an attacker on the network path between the operator and the control plane to intercept user or admin API tokens and perform unauthorized actions against the control plane.

Recommendations Update github.com/kumahq/kuma/v2 to version 2.9.16 or later. When adding an HTTPS control plane profile to kumactl, always use the --ca-cert-file parameter pointing to the control plane serving CA. Terminate the control plane behind a publicly trusted certificate to allow verification against the operating system trust store.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-50166

GHSA-V95X-XHQ5-4929

GO-2026-6010

Affected Products

Kuma

References · 6

• https://osv.dev/vulnerability/GHSA-v95x-xhq5-4929 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-6010 · Vendor Advisory
• https://github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a · Note
• https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929 · Note
• https://github.com/kumahq/kuma · Note
• https://github.com/kumahq/kuma/pull/16777 · Note