CVE-2026-50166: kumactl connects to control plane without verifying TLS certificate when no CA is configured

July 16, 2026

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection

References

github.com/advisories/GHSA-v95x-xhq5-4929
github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
github.com/kumahq/kuma/pull/16777
github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929
nvd.nist.gov/vuln/detail/CVE-2026-50166

Code Behaviors & Features

Detect and mitigate CVE-2026-50166 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →