CVE-2026-52724: kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

July 16, 2026

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection

References

github.com/advisories/GHSA-wvmp-6r4v-j6cv
github.com/kumahq/kuma/commit/2ecadac1aa2fd8cded4c2ab768949f4c2ec83e2a
github.com/kumahq/kuma/pull/16777
github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv
nvd.nist.gov/vuln/detail/CVE-2026-52724

Code Behaviors & Features

Detect and mitigate CVE-2026-52724 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →