TLS Peer Verification Bypass in Kuma Service Mesh by Kong
CVE-2026-52724
What is CVE-2026-52724?
The Kuma service mesh, developed by Kong, has a vulnerability where connections made in Universal mode to an HTTPS control plane fail to verify TLS peers if the --ca-cert-file option is not provided and KUMA_CONTROL_PLANE_CA_CERT is not set. This exposure allows an attacker on the network path to intercept the authentication token sent over the unverified connection. The attacker could impersonate the control plane, insert a malicious bootstrap configuration, and monopolize control over the proxy. It is important to note that standard deployments created through kumactl or official Helm charts are safeguarded against this issue due to automatic injection of the necessary CA certificate into each sidecar. The problem has been addressed in the updated versions of Kuma.
Affected Version(s)
kuma < 2.7.26 < 2.7.26
kuma >= 2.8.0, < 2.9.16 < 2.8.0, 2.9.16
kuma >= 2.10.0, < 2.11.14 < 2.10.0, 2.11.14