CVE-2026-18678: Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.
An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kong Meshto a version that resolves this vulnerability.Fixed in 2.7.26 - Upgrade
Upgrade
Kong Meshto a version that resolves this vulnerability.Fixed in 2.9.16 - Upgrade
Upgrade
Kong Meshto a version that resolves this vulnerability.Fixed in 2.11.14 - Upgrade
Upgrade
Kong Meshto a version that resolves this vulnerability.Fixed in 2.12.11 - Upgrade
Upgrade
Kong Meshto a version that resolves this vulnerability.Fixed in 2.13.7 - Compensating control
If using kumactl with an HTTPS control plane profile and no CA certificate is provided, ensure TLS verification is not disabled (provide the CA certificate / avoid unverified connections) so API tokens are not sent over an unverified TLS connection.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18678?
CVE-2026-18678 has a risk score of 65, indicating a medium severity vulnerability.
How do I fix CVE-2026-18678?
To fix CVE-2026-18678, provide a valid CA certificate when configuring the HTTPS control plane profile in kumactl.
What is the impact of CVE-2026-18678?
The impact of CVE-2026-18678 allows an attacker to intercept API tokens transmitted over an unverified TLS connection.
Who is affected by CVE-2026-18678?
Users of Kong Mesh who configure kumactl with an HTTPS control plane profile without a CA certificate are affected by CVE-2026-18678.
When was CVE-2026-18678 published?
CVE-2026-18678 was published on August 12, 2026.