CVE-2026-52724

Name of the Vulnerable Software and Affected Versions kuma-dp versions 2.8.0 through 2.9.15

Description When kuma-dp is started against an HTTPS control plane without a CA certificate, the data plane connects with TLS peer verification disabled. This causes the dataplane authentication token to be transmitted over an unverified connection. An on-path attacker can intercept this token and impersonate the control plane to the data plane, enabling the injection of a forged bootstrap configuration and subsequent takeover of the proxy. This issue specifically affects Universal mode kuma-dp when the --ca-cert-file parameter is not used or the KUMA CONTROL PLANE CA CERT variable is unset.

Recommendations Update kuma-dp to version 2.9.16 or later. Set the --ca-cert-file parameter or the KUMA CONTROL PLANE CA CERT variable on every Universal mode data plane to point to the control plane serving CA. Terminate the control plane behind a publicly trusted certificate to allow verification against the operating system trust store.