CVE-2026-52724: Cert Validation Flaw

Description

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.

Is your site exposed to CVE-2026-52724?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-295 CWE-295

References

Other References

https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870 https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3 https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569 https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980 https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11 https://github.com/kumahq/kuma/pull/16777 https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv

Frequently Asked Questions

What is CVE-2026-52724? +

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.

How do I check if I'm vulnerable to CVE-2026-52724? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-44700

Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate …

CVE-2025-9291

A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately …

CVE-2026-0277

An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) …

CVE-2025-3463

"This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability …

CVE-2025-5279

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step …

CVE-2025-34066

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with …

CVE-2026-52724