Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.
CVE-2026-50166
MEDIUMPre-NVD 5.55.5—Trending — 3 sources updated this week
EchelonGraph scoreMEDIUM confidence
This medium-severity CVE scores 5.5 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.2%, top 92% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
Triggered by: NVD CVSS baseline
Sources: epss, secondary
5.5EG
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
- Lower severity and no public exploit yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 5.5Exploit: None knownExposed: 0
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 5.5
- EG Score
- 5.5(medium)
- EG Risk
- 25(Track)EG Risk 25/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity55% × 45%Exploitation0% × 40%Automatability0% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 0%
- EPSS %ILE
- 8%
- KEV
- Not listed
Published
July 16, 2026
Last Modified
September 16, 2026
Advisory Details (8)
Auto-updated Sep 15, 2026Patch available. Sources: github, github_pr, github_commit.
github_commit Patch Available
commit eb81494c2c7a (kumahq/kuma)
Patch available: kumahq/kuma v2.13.7 (contains commit eb81494c2c7a)
https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11github_commit
commit d4ae0c015159 (kumahq/kuma)
Fix landed in kumahq/kuma commit d4ae0c015159 — awaiting tagged release
https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980github_commit Patch Available
commit bb56ae628753 (kumahq/kuma)
Patch available: kumahq/kuma v2.7.27 (contains commit bb56ae628753)
https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569github_commit Patch Available
commit a256af4869ae (kumahq/kuma)
Patch available: kumahq/kuma 2.9.16 (contains commit a256af4869ae)
https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3github_commit Patch Available
commit 85716397ffa4 (kumahq/kuma)
Patch available: kumahq/kuma v2.12.11 (contains commit 85716397ffa4)
https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870github_commit Patch Available
commit 2d0fb3829245 (kumahq/kuma)
Patch available: kumahq/kuma v2.11.14 (contains commit 2d0fb3829245)
https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940fgithub_pr Patch Available
fix(kuma-cp): use system trust when CA cert is not provided
Patch available: kumahq/kuma v2.14.0 (PR #16777 merged 2026-05-29)
https://github.com/kumahq/kuma/pull/16777github Patch Available
kumactl connects to control plane without verifying TLS certificate when no CA is configured · Advisory · kumahq/kuma · GitHub
https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929Vendor Advisories for CVE-2026-50166(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Affected Packages
(2 across 1 ecosystem)
Go(2)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| github.com/kumahq/kuma | — | — | — |
| github.com/kumahq/kuma/v2 | — | 2.13.7 | — |
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 8× in last 7d / 8× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-18 19:28 UTCEPSS rescore
- 2026-09-18 04:38 UTCEG score recompute
- 2026-09-16 17:11 UTCEG score recompute
- 2026-09-16 15:56 UTCEG score recompute
- 2026-09-16 14:08 UTCEPSS rescore
- 2026-09-15 15:35 UTCEG score recompute
- 2026-09-15 14:58 UTCEG score recompute▲ 5.50
- 2026-09-15 14:57 UTCMITRE cvelistV5CVSS v3 → 5.5 · CVSS v4 → 5.5
- 2026-08-01 04:54 UTCEG score recompute
- 2026-07-26 11:25 UTCEG score recompute
- 2026-07-23 03:18 UTCEG score recompute
- 2026-07-16 20:04 UTCEG score recompute
Related CVEs(same CWE)
Same CWE
10 shownCWE-295
Frequently asked(5)
What is CVE-2026-50166?
CVE-2026-50166 is a medium vulnerability published on July 16, 2026. Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens…
When was CVE-2026-50166 disclosed?
CVE-2026-50166 was first published in the National Vulnerability Database on July 16, 2026, with the most recent update on September 16, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-50166 actively exploited?
CVE-2026-50166 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 91.6% of all scored CVEs.
What is the CVSS score of CVE-2026-50166?
CVE-2026-50166 has a CVSS v3 base score of 5.5 (NVD).
How do I remediate CVE-2026-50166?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-50166, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-50166
Is Your Infrastructure Affected by CVE-2026-50166?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.