CVE-2026-52724
Description
A flaw was found in Kuma. In Universal mode, the kuma-dp component fails to verify the TLS (Transport Layer Security) certificate of the control plane when no Certificate Authority (CA) is configured. This allows an attacker positioned on the network path to intercept the authentication token, impersonate the control plane, and inject a malicious configuration, ultimately leading to a takeover of the proxy.
Statement
This vulnerability is rated as having Moderate impact because exploitation requires an attacker to be positioned on the network path between the data plane and the control plane under a non-default configuration where TLS verification is omitted. Standard Kubernetes and OpenShift environments are unaffected as admission webhooks automatically provision the control plane Certificate Authority (CA) into sidecars. Impact is therefore limited to Universal deployments where kuma-dp runs on standalone hosts or virtual machines without an explicitly specified CA certificate.
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
