TLS Verification Bypass in Kuma by Kong

CVE-2026-18678

What is CVE-2026-18678?

This vulnerability affects Kuma by Kong when an operator configures an HTTPS control plane profile without specifying a CA certificate. In this scenario, Kuma disables TLS verification, leading to the exposure of API tokens over an unsecured connection. An attacker able to intercept the network traffic could capture user or admin API tokens, enabling them to perform actions on the control plane as the compromised user. It is crucial for operators to ensure proper CA certificate usage to maintain the integrity and confidentiality of their communications.

References