CVE-2026-18678

{
  "id": "CVE-2026-18678",
  "sourceIdentifier": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
  "published": "2026-08-12T19:17:31.323",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.\n\n\n\nAn attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user."
    },
    {
      "lang": "es",
      "value": "Cuyo un operador añade un perfil de plano de control HTTPS a kumactl sin proporcionar un certificado de CA, kumactl deshabilita la verificación TLS y envía tokens de API a través de la conexión no verificada.\n\nUn atacante en la ruta de red entre el operador y el plano de control puede interceptar tokens de API de usuario o de administrador y luego actuar contra el plano de control como ese usuario."
    }
  ],
  "affected": [
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "affectedData": [
        {
          "vendor": "Kong Inc.",
          "product": "Kong Mesh",
          "defaultStatus": "unaffected",
          "modules": [
            "kumactl"
          ],
          "platforms": [
            "Linux"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "2.7.26",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.8.0",
              "lessThan": "2.9.16",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.10.0",
              "lessThan": "2.11.14",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.12.0",
              "lessThan": "2.12.11",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "2.13.0",
              "lessThan": "2.13.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-13T14:47:28.559922Z",
          "id": "CVE-2026-18678",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://developer.konghq.com/mesh/changelog/",
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"
    },
    {
      "url": "https://github.com/kumahq/kuma/pull/16777",
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"
    },
    {
      "url": "https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929",
      "source": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"
    }
  ]
}