Kuma, an Envoy-based service mesh, suffers from CWE-295: Improper Certificate Validation in Universal mode prior to versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7. Specifically, if the --ca-cert-file flag is not supplied and the KUMA_CONTROL_PLANE_CA_CERT environment variable is unset, TLS peer verification is disabled for kuma-dp connections to an HTTPS control plane. This allows an on-path attacker to intercept the dataplane authentication token, impersonate the control plane, inject forged bootstrap configurations, and take control of the proxy. Kubernetes installations created by kumactl install control-plane or the official Helm chart are unaffected because they inject the necessary certificate environment variable via a mutating admission webhook. The vulnerability is addressed in the listed fixed versions.

An attacker positioned on the network path can intercept the dataplane authentication token due to disabled TLS peer verification, enabling impersonation of the control plane. This can lead to injection of forged configurations and full takeover of the proxy component. However, standard Kubernetes deployments using official installation methods are not vulnerable. The CVSS 4.0 base score is 5.8 (medium severity), reflecting the complexity and attack vector.

Upgrade to Kuma versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, or 2.13.7 or later, where this issue is fixed. For deployments not using the standard Kubernetes installation methods, ensure that TLS peer verification is enabled by supplying the --ca-cert-file flag or setting the KUMA_CONTROL_PLANE_CA_CERT environment variable. Standard Kubernetes installations using kumactl install control-plane or the official Helm chart are not affected and require no additional action.