Résumé
kumactl connects to control plane without verifying TLS certificate when no CA is configured
Détails de l’avis
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection
Impact
An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user
Affected configurations
kumactlprofiles manually added against an HTTPS control plane endpoint without--ca-cert-file
Not affected
- The default local profile, which uses plain HTTP
Workarounds
When adding an HTTPS control plane profile to kumactl, always pass --ca-cert-file pointing at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration
Resources
Références
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-55215
MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`
- MEDIUMCVE-2026-63336
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
- MEDIUMCVE-2026-69248
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
- CRITICALCVE-2026-46428
lettre has TLS hostname verification disabled when using Boring TLS backend
- HIGHCVE-2026-56820
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
- HIGHCVE-2026-54481
Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override