Kuma: kumactl HTTPS profile without a CA file skips verification and leaks admin API tokens

Impact

A kumactl profile manually pointed at an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends the user's API token over that unverified connection. An attacker on the network path can capture an operator or administrator token and then drive the control plane as that user - mesh policy, traffic permissions and dataplane configuration for the whole cluster. This is the operator-side counterpart to the kuma-dp issue (CVE-2026-52724) and ships in the same releases, but the affected component and the exposed credential differ: this one hands over a human's API token, not a dataplane token. The default local profile uses plain HTTP and is unaffected.

Who can reach it

An attacker on the network path between an operator's workstation running kumactl and the control plane, with the operator using a manually configured HTTPS profile that lacks a CA file. No authentication required of the attacker; it requires the operator to run a command.

What to do

Upgrade to Kuma 2.7.26, 2.9.16, 2.11.14, 2.12.11 or 2.13.7, and set --ca-cert-file in every kumactl profile that targets an HTTPS control plane. Updating kumactl is a client-side binary swap on operator machines, not a fleet maintenance window, but rotate any admin API tokens that were used over an unverified connection.

References

Related entries

• ACM must-gather: wrapper CRs embedding Secret data are collected unredacted into the support archiveCVE-2026-73834 · Red Hat Advanced Cluster Management must-gather (ACM wrapper CRs embedding Secret data)Medium
• ACM must-gather: cluster Proxy object dumped raw, exposing proxy basic-auth credentialsCVE-2026-75485 · Red Hat Advanced Cluster Management must-gather (cluster Proxy object collection)Medium
• runc (linux.resources.devices cgroup list handling): MULTI-TENANT DEVICE ISOLATION: runc implemented theNCVD-2020-005-runc-linux-resources-devices-cgr · runc (linux.resources.devices cgroup list handling)Medium
• etcd (write-ahead log, user authentication entries): CONTROL-PLANE CREDENTIALS AT REST IN CLEARTEXT: etcd writes theNCVD-2020-006-etcd-write-ahead-log-user-authen · etcd (write-ahead log, user authentication entries)Medium
• containerd (default mounts, /sys/devices/virtual/powercap RAPL): Containers get read access to Intel RAPL powerNCVD-2023-009-containerd-default-mounts-sys-de · containerd (default mounts, /sys/devices/virtual/powercap RAPL)Medium
• Kubernetes (kubelet/kube-proxy): Node's 127.0.0.1-bound services reachable from adjacent hosts and podsCVE-2020-8558 · Kubernetes (kubelet/kube-proxy)Medium