Vulnerabilities

TI-2026-36929 CVE-2026-50166 · GHSA-v95x-xhq5-4929

Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

LOW 25

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs.

CVSS 4.0MEDIUM 5.5 Adjacent network No auth User interaction EPSS 0.00275 Published 2026-09-15 Fixed in 2.7.26, 2.9.16 +3 CWE-295

TI-2026-37844 CVE-2026-52724 · GHSA-wvmp-6r4v-j6cv

LOW 26

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs.

CVSS 4.0MEDIUM 5.8 Adjacent network No auth No interaction EPSS 0.0035 Published 2026-09-15 Fixed in 2.7.26, 2.9.16 +3 CWE-295

TI-2026-32876 CVE-2026-45021 · GHSA-3vcp-chfh-f6r2

LOW 29

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00276 Published 2026-05-28 Fixed in 2.7.25, 2.9.15 +3 CWE-346