CVE-2026-50166: kumactl connects to control plane without verifying TLS certificate when no CA is configured

July 16, 2026

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection

References

github.com/advisories/GHSA-v95x-xhq5-4929
github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
github.com/kumahq/kuma/pull/16777
github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
nvd.nist.gov/vuln/detail/CVE-2026-50166

Code Behaviors & Features

Detect and mitigate CVE-2026-50166 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →