When kuma-dp connects to an HTTPS control plane without an explicit CA certificate configured, it silently disables peer verification while maintaining the HTTPS connection. You see a working, encrypted connection. You have no signal that certificate verification is disabled. This is the core failure: the system presents the visual language of TLS security while having removed its实质性 protection.
The attack path is straightforward. An on-path actor intercepts the dataplane bootstrap request and captures the authentication token. That token grants arbitrary control over the proxy configuration, enabling traffic injection, interception, and complete proxy takeover. One interception point collapses the entire east-west traffic matrix flowing through that data plane.
This affects you if: you deployed kuma-dp with an HTTPS control plane URL and did not explicitly provision and configure a CA certificate. The vulnerability triggers on that exact configuration—not a misconfiguration you made, but the default state the tooling accepts without warning.
What to check: review your kuma-dp bootstrap configuration and confirm the controlPlane.caCert field contains a valid CA certificate. If the field is absent or empty, your connection is running unverified. Check the kuma-dp logs for any TLS handshake warnings that were previously dismissed. In production environments, this configuration should be unacceptable regardless of network trust assumptions.
What to do: provision a CA certificate for inter-component communication and update your kuma-dp configuration to reference it. If you cannot do this immediately, treat any traffic to the control plane as potentially compromised—the token is not safe. Monitor for configuration drift back to unverified states in future deployments or scaling events.
The design failure here is that Kuma accepts an HTTPS endpoint, produces a working connection, and never signals that verification is disabled. Systems that accept HTTPS should either require verified certificates or refuse to connect—the silent degradation from verified to unverified TLS is a security failure masquerading as a deployment flexibility feature.