CVE-2026-52724: kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

July 16, 2026

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection

References

github.com/advisories/GHSA-wvmp-6r4v-j6cv
github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
github.com/kumahq/kuma/pull/16777
github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
nvd.nist.gov/vuln/detail/CVE-2026-52724

Code Behaviors & Features

Detect and mitigate CVE-2026-52724 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →