Description
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.
An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kong | Kong Mesh | < 2.7.26, 2.8.0 – < 2.9.16, 2.10.0 – < 2.11.14, 2.12.0 – < 2.12.11, 2.13.0 – < 2.13.7 | 2.7.26 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kumahq/kuma | <= 1.8.1 | — | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma | all versions | — | GO-2026-6013 |
| Go | github.com/kumahq/kuma/v2 | < 2.7.26 | 2.7.26 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | >= 2.8.0, < 2.9.16 | 2.9.16 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | >= 2.10.0, < 2.11.14 | 2.11.14 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | >= 2.12.0, < 2.12.11 | 2.12.11 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | >= 2.13.0, < 2.13.7 | 2.13.7 | GHSA-wvmp-6r4v-j6cv |
| Go | github.com/kumahq/kuma/v2 | < 2.7.26 · >= 2.9.13, < 2.11.14 · >= 2.12.4, < 2.12.11 · >= 2.13.0, < 2.13.7 | 2.7.26, 2.11.14, 2.12.11, 2.13.7 | GO-2026-6013 |
References
- Upstream advisory GHSA-wvmp-6r4v-j6cv vendor-advisory
- kumahq/kuma#16777 (master) patch
- Kong MESH Changelog release-notes