Vulnerabilities CVE-2026-18678

CVE-2026-18678

Medium

Open

TLP:CLEAR

Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.

Details

CVSS Score: 5.5
EPSS Score ⓘ: 0.10%

0.8th percentile
CVSS Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Confidence: 90%
Published: Aug 12, 2026
Last Modified: Aug 13, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.