Executive brief
Kuma is a service mesh platform used to manage and secure communication between microservices. A security flaw in its command-line tool, kumactl, causes it to skip security certificate checks when connecting to a management server over HTTPS if a specific certificate file isn't provided. This allows an attacker on the same network to intercept sensitive administrative login tokens, potentially gaining full control over the service mesh infrastructure.
Technical details
A vulnerability exists in kumactl (and related components like kuma-dp) where the application defaults to an insecure TLS configuration (InsecureSkipVerify) when a CA certificate is not explicitly provided via the --ca-cert-file flag. This improper certificate validation (CWE-295) occurs during the establishment of connections to the HTTPS control plane. An attacker positioned on the network path (adjacent) can perform a Man-in-the-Middle (MitM) attack to intercept cleartext API tokens sent by the operator. Patched versions resolve this by falling back to the system trust store or requiring explicit TLS configuration instead of disabling verification.
Affected products
- Kong Kuma <= 1.8.1
- Kong Kuma >= 2.7.0, < 2.7.26
- Kong Kuma >= 2.8.0, < 2.9.16
- Kong Kuma >= 2.10.0, < 2.11.14
- Kong Kuma >= 2.12.0, < 2.12.11
- Kong Kuma >= 2.13.0, < 2.13.7
Timeline
- 2026-05-29: patched: Fix merged into master branch
- 2026-07-16: advisory: GitHub Advisory published