The vulnerability arises when kuma-dp connects to an HTTPS control plane without a CA certificate configured, resulting in TLS peer verification being disabled. Consequently, the dataplane authentication token is transmitted over an unverified TLS connection. An attacker positioned on the network path can intercept this token and impersonate the control plane to the data plane, enabling injection of forged bootstrap configurations and takeover of the proxy component.

An attacker with network access between the data plane and control plane can intercept sensitive authentication tokens and impersonate the control plane. This allows the attacker to inject malicious configurations into the data plane proxy, effectively taking control of it. The vulnerability compromises the integrity and authenticity of the communication channel between control and data planes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or workaround is provided, operators should ensure that a valid CA certificate is always supplied when starting kuma-dp against an HTTPS control plane to avoid disabling TLS peer verification.