Executive brief
Kuma is a service mesh platform used to manage and secure communication between different software services. A security flaw in the Kuma data plane component (kuma-dp) allows it to connect to its management server without verifying the server's identity if a specific security certificate is not manually configured. An attacker positioned on the same network could exploit this to steal authentication credentials and take full control over the service proxy, potentially intercepting or redirecting sensitive application traffic.
Technical details
A vulnerability exists in kuma-dp's remote bootstrap process where TLS peer verification is disabled by default if the '--ca-cert-file' flag or 'KUMA_CONTROL_PLANE_CA_CERT' environment variable is not set. This root cause is an insecure fallback in the 'ConfigureMTLS' and bootstrap client logic that sets 'InsecureSkipVerify' to true when a CA is missing. An on-path attacker (Adjacent Attack Vector) can perform a Man-in-the-Middle (MitM) attack to intercept the dataplane authentication token. With this token, the attacker can impersonate the control plane and inject a forged bootstrap configuration, resulting in a complete takeover of the Envoy proxy. The issue primarily affects 'Universal mode' deployments; Kubernetes deployments using standard installers are generally protected by automatic CA injection.
Affected products
- Kumahq Kuma <= 1.8.1, < 2.7.26, 2.8.0 to 2.9.15, 2.10.0 to 2.11.13, 2.12.0 to 2.12.10, 2.13.0 to 2.13.6
Timeline
- 2026-05-29: patched: Fix merged in pull request 16777
- 2026-07-16: disclosed: Advisory published via GitHub Security Advisory (GHSA)