Search

Find a vulnerability

Search criteria

    8 vulnerabilities by kumahq

    CVE-2026-52724 (GCVE-0-2026-52724)

    Vulnerability from nvd – Published: 2026-09-15 14:50 – Updated: 2026-09-15 15:21
    VLAI
    Title
    kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
    Summary
    Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
    Severity
    5.8 (Medium)
    CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-15 15:20 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7637 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kumahq kuma Affected: < 2.7.26
    Affected: >= 2.8.0, < 2.9.16
    Affected: >= 2.10.0, < 2.11.14
    Affected: >= 2.12.0, < 2.12.11
    Affected: >= 2.13.0, < 2.13.7
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52724",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T15:20:22.070620Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T15:21:20.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kuma",
          "vendor": "kumahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.7.26"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.8.0, \u003c 2.9.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.10.0, \u003c 2.11.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.12.0, \u003c 2.12.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.13.0, \u003c 2.13.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T14:50:32.257Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16777",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16777"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11"
        }
      ],
      "source": {
        "advisory": "GHSA-wvmp-6r4v-j6cv",
        "discovery": "UNKNOWN"
      },
      "title": "kuma-dp connects to control plane without verifying TLS certificate when no CA is configured"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52724",
    "datePublished": "2026-09-15T14:50:32.257Z",
    "dateReserved": "2026-06-08T14:00:43.571Z",
    "dateUpdated": "2026-09-15T15:21:20.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-50166 (GCVE-0-2026-50166)

    Vulnerability from nvd – Published: 2026-09-15 14:52 – Updated: 2026-09-16 15:50
    VLAI
    Title
    Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured
    Summary
    Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
    Severity
    5.5 (Medium)
    CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-16 15:50 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7637 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kumahq kuma Affected: < 2.7.26
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50166",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:50:05.694452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:50:24.712Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kuma",
          "vendor": "kumahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.7.26"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T14:52:30.085Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16777",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16777"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11"
        }
      ],
      "source": {
        "advisory": "GHSA-v95x-xhq5-4929",
        "discovery": "UNKNOWN"
      },
      "title": "Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50166",
    "datePublished": "2026-09-15T14:52:30.085Z",
    "dateReserved": "2026-06-03T20:54:20.433Z",
    "dateUpdated": "2026-09-16T15:50:24.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-45021 (GCVE-0-2026-45021)

    Vulnerability from nvd – Published: 2026-05-28 17:45 – Updated: 2026-05-28 19:30
    VLAI
    Title
    Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
    Summary
    Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-28 19:30 UTC
    CWE
    • CWE-346 - Origin Validation Error
    • CWE-942 - Permissive Cross-domain Policy with Untrusted Domains
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7637 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kumahq kuma Affected: < 2.7.25
    Affected: >= 2.9.0, < 2.9.15
    Affected: >= 2.11.0, < 2.11.13
    Affected: >= 2.12.0, < 2.12.10
    Affected: >= 2.13.0, < 2.13.5
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45021",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T19:30:17.834875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T19:30:33.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kuma",
          "vendor": "kumahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.7.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.9.0, \u003c 2.9.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.11.0, \u003c 2.11.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.12.0, \u003c 2.12.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.13.0, \u003c 2.13.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T17:45:14.434Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16416",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16416"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16423",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16423"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16424",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16424"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16425",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16425"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16426",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16426"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16427",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16427"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907"
        }
      ],
      "source": {
        "advisory": "GHSA-3vcp-chfh-f6r2",
        "discovery": "UNKNOWN"
      },
      "title": "Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45021",
    "datePublished": "2026-05-28T17:45:14.434Z",
    "dateReserved": "2026-05-08T16:58:28.896Z",
    "dateUpdated": "2026-05-28T19:30:33.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-36542 (GCVE-0-2024-36542)

    Vulnerability from nvd – Published: 2024-07-25 00:00 – Updated: 2025-03-13 20:20
    VLAI
    Summary
    Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-07-29 17:02 UTC
    CWE
    • n/a
    • CWE-277 - Insecure Inherited Permissions
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 28/100 over 2325 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kumahq kuma Affected: 2.7.0
        cpe:2.3:a:kumahq:kuma:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kumahq:kuma:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "kuma",
            "vendor": "kumahq",
            "versions": [
              {
                "status": "affected",
                "version": "2.7.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36542",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-29T17:02:06.574579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-277",
                "description": "CWE-277 Insecure Inherited Permissions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T20:20:27.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:37:05.334Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/HouqiyuA/e1685843b6f42b47dbf97e2e92e63428"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account\u0027s token."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-25T16:45:27.197Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gist.github.com/HouqiyuA/e1685843b6f42b47dbf97e2e92e63428"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-36542",
    "datePublished": "2024-07-25T00:00:00.000Z",
    "dateReserved": "2024-05-30T00:00:00.000Z",
    "dateUpdated": "2025-03-13T20:20:27.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2026-50166 (GCVE-0-2026-50166)

    Vulnerability from cvelistv5 – Published: 2026-09-15 14:52 – Updated: 2026-09-16 15:50
    VLAI
    Title
    Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured
    Summary
    Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
    Severity
    5.5 (Medium)
    CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-16 15:50 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7637 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kumahq kuma Affected: < 2.7.26
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50166",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:50:05.694452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:50:24.712Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kuma",
          "vendor": "kumahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.7.26"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T14:52:30.085Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16777",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16777"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11"
        }
      ],
      "source": {
        "advisory": "GHSA-v95x-xhq5-4929",
        "discovery": "UNKNOWN"
      },
      "title": "Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50166",
    "datePublished": "2026-09-15T14:52:30.085Z",
    "dateReserved": "2026-06-03T20:54:20.433Z",
    "dateUpdated": "2026-09-16T15:50:24.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-52724 (GCVE-0-2026-52724)

    Vulnerability from cvelistv5 – Published: 2026-09-15 14:50 – Updated: 2026-09-15 15:21
    VLAI
    Title
    kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
    Summary
    Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
    Severity
    5.8 (Medium)
    CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-15 15:20 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7637 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kumahq kuma Affected: < 2.7.26
    Affected: >= 2.8.0, < 2.9.16
    Affected: >= 2.10.0, < 2.11.14
    Affected: >= 2.12.0, < 2.12.11
    Affected: >= 2.13.0, < 2.13.7
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52724",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T15:20:22.070620Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T15:21:20.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kuma",
          "vendor": "kumahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.7.26"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.8.0, \u003c 2.9.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.10.0, \u003c 2.11.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.12.0, \u003c 2.12.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.13.0, \u003c 2.13.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and KUMA_CONTROL_PLANE_CA_CERT is unset. The dataplane authentication token is sent over the unverified connection, allowing an on-path attacker to intercept the token, impersonate the control plane, inject a forged bootstrap configuration, and take over the proxy. Standard Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because the mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into each sidecar. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T14:50:32.257Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16777",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16777"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11"
        }
      ],
      "source": {
        "advisory": "GHSA-wvmp-6r4v-j6cv",
        "discovery": "UNKNOWN"
      },
      "title": "kuma-dp connects to control plane without verifying TLS certificate when no CA is configured"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52724",
    "datePublished": "2026-09-15T14:50:32.257Z",
    "dateReserved": "2026-06-08T14:00:43.571Z",
    "dateUpdated": "2026-09-15T15:21:20.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-45021 (GCVE-0-2026-45021)

    Vulnerability from cvelistv5 – Published: 2026-05-28 17:45 – Updated: 2026-05-28 19:30
    VLAI
    Title
    Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
    Summary
    Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-28 19:30 UTC
    CWE
    • CWE-346 - Origin Validation Error
    • CWE-942 - Permissive Cross-domain Policy with Untrusted Domains
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7637 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kumahq kuma Affected: < 2.7.25
    Affected: >= 2.9.0, < 2.9.15
    Affected: >= 2.11.0, < 2.11.13
    Affected: >= 2.12.0, < 2.12.10
    Affected: >= 2.13.0, < 2.13.5
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45021",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T19:30:17.834875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T19:30:33.327Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kuma",
          "vendor": "kumahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.7.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.9.0, \u003c 2.9.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.11.0, \u003c 2.11.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.12.0, \u003c 2.12.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.13.0, \u003c 2.13.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [\".*\"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T17:45:14.434Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16416",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16416"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16423",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16423"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16424",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16424"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16425",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16425"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16426",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16426"
        },
        {
          "name": "https://github.com/kumahq/kuma/pull/16427",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/pull/16427"
        },
        {
          "name": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kumahq/kuma/commit/8fefa8595d44eb68d922405702ed7a0826322907"
        }
      ],
      "source": {
        "advisory": "GHSA-3vcp-chfh-f6r2",
        "discovery": "UNKNOWN"
      },
      "title": "Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45021",
    "datePublished": "2026-05-28T17:45:14.434Z",
    "dateReserved": "2026-05-08T16:58:28.896Z",
    "dateUpdated": "2026-05-28T19:30:33.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-36542 (GCVE-0-2024-36542)

    Vulnerability from cvelistv5 – Published: 2024-07-25 00:00 – Updated: 2025-03-13 20:20
    VLAI
    Summary
    Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-07-29 17:02 UTC
    CWE
    • n/a
    • CWE-277 - Insecure Inherited Permissions
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 28/100 over 2325 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kumahq kuma Affected: 2.7.0
        cpe:2.3:a:kumahq:kuma:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kumahq:kuma:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "kuma",
            "vendor": "kumahq",
            "versions": [
              {
                "status": "affected",
                "version": "2.7.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36542",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-29T17:02:06.574579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-277",
                "description": "CWE-277 Insecure Inherited Permissions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T20:20:27.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:37:05.334Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/HouqiyuA/e1685843b6f42b47dbf97e2e92e63428"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account\u0027s token."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-25T16:45:27.197Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gist.github.com/HouqiyuA/e1685843b6f42b47dbf97e2e92e63428"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-36542",
    "datePublished": "2024-07-25T00:00:00.000Z",
    "dateReserved": "2024-05-30T00:00:00.000Z",
    "dateUpdated": "2025-03-13T20:20:27.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}