Is github.com/kumahq/kuma/v2 affected by CVE-2026-50166?

Go github.com/kumahq/kuma/v2 is affected in = 2.8.0 = 2.10.0 = 2.12.0 = 2.13.0 < 2.13.7.

Is CVE-2026-50166 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

medium

CVE-2026-50166

Q: Is CVE-2026-50166 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

Go · github.com/kumahq/kuma/v2

Summary

kumactl connects to control plane without verifying TLS certificate when no CA is configured

Severity: medium
EPSS: 0.3% (p20)
CWE: CWE-295
Also known as: GHSA-v95x-xhq5-4929#github.com/kumahq/kuma/v2
Published: 2026-07-16
Updated: 2026-07-16

Advisory details

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection

Impact

An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user

Affected configurations

kumactl profiles manually added against an HTTPS control plane endpoint without --ca-cert-file

Not affected

The default local profile, which uses plain HTTP

Workarounds

When adding an HTTPS control plane profile to kumactl, always pass --ca-cert-file pointing at the control plane's serving CA. Alternatively, terminate the control plane behind a publicly trusted certificate; the patched releases will verify successfully against the operating system trust store with no further configuration

Resources

Fix: https://github.com/kumahq/kuma/pull/16777

References

Related advisories

CVE-2026-52724 — medium · Go/github.com/kumahq/kuma/v2
GHSA-hq85-5cpj-mr62 — critical · PyPI/uv
GHSA-6q48-6c7w-9gw2 — critical · PyPI/certifi
CVE-2026-105794 — critical · NuGet/Microsoft.Native.Quic.MsQuic.OpenSSL
CVE-2026-63374 — critical · PyPI/anyio
CVE-2026-46428 — critical · crates.io/lettre
CVE-2026-42508 — critical · Go/golang.org/x/crypto/ssh/knownhosts
CVE-2026-96222 — high · NuGet/System.Security.Cryptography.Xml

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.