Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/kumahq/kuma/v2

6 known vulnerabilities (6 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 6 medium
Registry
pkg.go.dev

Advisories 6

  • CVE-2026-50166Medium 5.5

    Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

    Affected: fixed in 2.7.26; from 2.9.13, fixed in 2.11.14; from 2.12.4, fixed in 2.12.11; from 2.13.0, fixed in 2.13.7; fixed in 2.7.26; from 2.8.0, fixed in 2.9.16; from 2.10.0, fixed in 2.11.14; from 2.12.0, fixed in 2.12.11; from 2.13.0, fixed in 2.13.7.

  • CVE-2026-52724Medium 5.8

    kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

    Affected: fixed in 2.7.26; from 2.9.13, fixed in 2.11.14; from 2.12.4, fixed in 2.12.11; from 2.13.0, fixed in 2.13.7; fixed in 2.7.26; from 2.8.0, fixed in 2.9.16; from 2.10.0, fixed in 2.11.14; from 2.12.0, fixed in 2.12.11; from 2.13.0, fixed in 2.13.7.

  • CVE-2026-18679Medium 5.8

    Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured

    Affected: fixed in 2.7.26; from 2.9.13, fixed in 2.11.14; from 2.12.4, fixed in 2.12.11; from 2.13.0, fixed in 2.13.7; fixed in 2.7.26; from 2.8.0, fixed in 2.9.16; from 2.10.0, fixed in 2.11.14; from 2.12.0, fixed in 2.12.11; from 2.13.0, fixed in 2.13.7.

  • CVE-2026-18678Medium 5.5

    Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

    Affected: fixed in 2.7.26; from 2.9.13, fixed in 2.11.14; from 2.12.4, fixed in 2.12.11; from 2.13.0, fixed in 2.13.7; fixed in 2.7.26; from 2.8.0, fixed in 2.9.16; from 2.10.0, fixed in 2.11.14; from 2.12.0, fixed in 2.12.11; from 2.13.0, fixed in 2.13.7.

  • CVE-2026-18676Medium 5.1

    Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

    Affected: fixed in 2.7.25; from 2.9.13, fixed in 2.11.13; from 2.12.4, fixed in 2.12.10; from 2.13.0, fixed in 2.13.5.

  • CVE-2026-45021Medium 5.1

    Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

    Affected: fixed in 2.7.25; from 2.9.13, fixed in 2.11.13; from 2.12.4, fixed in 2.12.10; from 2.13.0, fixed in 2.13.5.