Executive brief
Kong Kubernetes Ingress Controller (KIC), a tool used to manage external access to services in a Kubernetes cluster, is vulnerable to a denial-of-service attack. A user with limited permissions to create 'Secrets' within a single namespace can trigger a failure that prevents any new configuration changes from being applied across the entire cluster. This means that while existing traffic may continue to flow, administrators will be unable to update routes, security policies, or other critical ingress settings until the malicious entry is removed.
Technical details
A vulnerability in Kong Kubernetes Ingress Controller (KIC) stems from how it collects CA-certificate Secrets across watched namespaces. KIC uses a label selector (konghq.com/ca-cert=true) without enforcing ingress-class or namespace restrictions, and it derives the CA-certificate primary key (ID) directly from a user-supplied field in the Secret. An attacker with namespace-scoped permissions can create a Secret with a duplicate ID, causing the Kong Gateway to reject the entire declarative configuration document. This results in a cluster-wide denial of service for configuration updates, halting all pending changes to routes, services, and plugins. The issue is fixed in versions 3.4.18 and 3.5.11 by implementing per-object translation failure handling instead of rejecting the full configuration push.
Affected products
- Kong kubernetes-ingress-controller <= 3.5.10, <= 3.4.17
Timeline
- 2026-07-29: advisory
- 2026-07-29: patched