Suggestions search

Untriaged

Filter by:

With package: python313Packages.pythonkuma

Found 2 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-50166

5.5 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Adjacent (A)
Attack Complexity (AC): High (H)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): High (H)
Modified Attack Vector (MAV): Adjacent (A)
Modified Attack Complexity (MAC): High (H)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): High (H)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 22 hours ago Activity log

Created suggestion 22 hours ago

Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens over the unverified connection. An attacker on the network path can intercept user or administrator API tokens and act against the control plane as the compromised user. The default local profile is unaffected because it uses plain HTTP. This issue is fixed in versions 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7.

References

https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929 x_refsource_CONFIRM
https://github.com/kumahq/kuma/pull/16777 x_refsource_MISC
https://github.com/kumahq/kuma/commit/2d0fb382924598f8746bc85c896f50384675940f x_refsource_MISC
https://github.com/kumahq/kuma/commit/85716397ffa404234bf365da0967eca0b0fa1870 x_refsource_MISC
https://github.com/kumahq/kuma/commit/a256af4869ae7e0ebbc2a14dc231e04ac8df1ba3 x_refsource_MISC
https://github.com/kumahq/kuma/commit/bb56ae628753aaec1f7846a514ab4edc35c0b569 x_refsource_MISC
https://github.com/kumahq/kuma/commit/d4ae0c0151596be991897651f20c5cdf32de1980 x_refsource_MISC
https://github.com/kumahq/kuma/commit/eb81494c2c7a5536e55c19cdde51b02a03b51e11 x_refsource_MISC

Affected products

kuma

==< 2.7.26

Matching in nixpkgs

pkgs.kuma

Service mesh controller

nixos-unstable 2.12.3
- nixpkgs-unstable 2.12.3
- nixos-unstable-small 2.12.3
nixos-26.05 2.12.3
- nixos-26.05-small 2.12.3
- nixpkgs-26.05-darwin 2.12.3

pkgs.kuma-cp

Service mesh controller

nixos-unstable 2.12.3
- nixpkgs-unstable 2.12.3
- nixos-unstable-small 2.12.3
nixos-26.05 2.12.3
- nixos-26.05-small 2.12.3
- nixpkgs-26.05-darwin 2.12.3

pkgs.kuma-dp

Service mesh controller

nixos-unstable 2.12.3
- nixpkgs-unstable 2.12.3
- nixos-unstable-small 2.12.3
nixos-26.05 2.12.3
- nixos-26.05-small 2.12.3
- nixpkgs-26.05-darwin 2.12.3

pkgs.kumactl

Service mesh controller

nixos-unstable 2.12.3
- nixpkgs-unstable 2.12.3
- nixos-unstable-small 2.12.3
nixos-26.05 2.12.3
- nixos-26.05-small 2.12.3
- nixpkgs-26.05-darwin 2.12.3

pkgs.autokuma

Utility that automates the creation of Uptime Kuma monitors

nixos-unstable 2.0.0
- nixpkgs-unstable 2.0.0
- nixos-unstable-small 2.0.0
nixos-26.05 2.0.0
- nixos-26.05-small 2.0.0
- nixpkgs-26.05-darwin 2.0.0

pkgs.uptime-kuma

Fancy self-hosted monitoring tool

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.5.4
nixos-26.05 2.4.0
- nixos-26.05-small 2.5.4
- nixpkgs-26.05-darwin 2.4.0

pkgs.kuma-experimental

Service mesh controller

nixos-unstable 2.12.3
- nixpkgs-unstable 2.12.3
- nixos-unstable-small 2.12.3
nixos-26.05 2.12.3
- nixos-26.05-small 2.12.3
- nixpkgs-26.05-darwin 2.12.3

pkgs.python313Packages.apykuma

Small library to notify Uptime Kuma that the service is up

nixos-unstable 1.2.0
- nixpkgs-unstable 1.2.0
- nixos-unstable-small 1.2.0
nixos-26.05 1.2.0
- nixos-26.05-small 1.2.0
- nixpkgs-26.05-darwin 1.2.0

pkgs.python314Packages.apykuma

Small library to notify Uptime Kuma that the service is up

nixos-unstable 1.2.0
- nixpkgs-unstable 1.2.0
- nixos-unstable-small 1.2.0
nixos-26.05 1.2.0
- nixos-26.05-small 1.2.0
- nixpkgs-26.05-darwin 1.2.0

pkgs.python313Packages.pythonkuma

Simple Python wrapper for Uptime Kuma

nixos-unstable 0.5.1
- nixpkgs-unstable 0.5.1
- nixos-unstable-small 0.5.2
nixos-26.05 0.5.0
- nixos-26.05-small 0.5.0
- nixpkgs-26.05-darwin 0.5.0

pkgs.python314Packages.pythonkuma

Simple Python wrapper for Uptime Kuma

nixos-unstable 0.5.1
- nixpkgs-unstable 0.5.1
- nixos-unstable-small 0.5.2
nixos-26.05 0.5.0
- nixos-26.05-small 0.5.0
- nixpkgs-26.05-darwin 0.5.0

pkgs.python313Packages.uptime-kuma-api

Python wrapper for the Uptime Kuma Socket.IO API

nixos-unstable 1.2.1
- nixpkgs-unstable 1.2.1
- nixos-unstable-small 1.2.1
nixos-26.05 1.2.1
- nixos-26.05-small 1.2.1
- nixpkgs-26.05-darwin 1.2.1

pkgs.python314Packages.uptime-kuma-api

Python wrapper for the Uptime Kuma Socket.IO API

nixos-unstable 1.2.1
- nixpkgs-unstable 1.2.1
- nixos-unstable-small 1.2.1
nixos-26.05 1.2.1
- nixos-26.05-small 1.2.1
- nixpkgs-26.05-darwin 1.2.1

pkgs.gnomeExtensions.uptime-kuma-indicator

Displays the status of an Uptime Kuma instance in the panel.

nixos-unstable 8
- nixpkgs-unstable 8
- nixos-unstable-small 10
nixos-26.05 8
- nixos-26.05-small 8
- nixpkgs-26.05-darwin 8

pkgs.python313Packages.uptime-kuma-monitor

Python wrapper around UptimeKuma /metrics endpoint

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.python314Packages.uptime-kuma-monitor

Python wrapper around UptimeKuma /metrics endpoint

nixos-unstable 1.0.0
- nixpkgs-unstable 1.0.0
- nixos-unstable-small 1.0.0
nixos-26.05 1.0.0
- nixos-26.05-small 1.0.0
- nixpkgs-26.05-darwin 1.0.0

pkgs.vscode-extensions.tekumara.typos-vscode

VSCode extension for providing a low false-positive source code spell checker

nixos-unstable 0.1.51
- nixpkgs-unstable 0.1.51
- nixos-unstable-small 0.1.55
nixos-26.05 0.1.51
- nixos-26.05-small 0.1.51
- nixpkgs-26.05-darwin 0.1.51

Package maintainers

@hrenard Hugo Renard <hugo.renard@proton.me>
@honnip Jung seungwoo <me@honnip.page>
@PerchunPak Perchun Pak <nixpkgs@perchun.it>
@JamieMagee Jamie Magee <jamie.magee@gmail.com>
@JulienMalka Julien Malka <julien.malka@me.com>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@felixsinger Felix Singer <felixsinger@posteo.net>

Permalink CVE-2026-45021

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 3 months, 2 weeks ago Activity log

Created suggestion 3 months, 2 weeks ago

Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.