CVE-2026-15228: Kong Kubernetes Ingress Controller denial of service via duplicate CA-certificate IDs

CVE-2026-15228 · Severity: info · CVSS 7.1 · Published 2026-07-29

Kong Kubernetes Ingress Controller (KIC), a tool used to manage external access to services in a Kubernetes cluster, is vulnerable to a denial-of-service attack. A user with limited permissions to create 'Secrets' within a single namespace can trigger a failure that prevents any new configuration changes from being applied across the entire cluster. This means that while existing traffic may continue to flow, administrators will be unable to update routes, security policies, or other critical ingress settings until the malicious entry is removed.

Technologies: Kong Kubernetes Ingress Controller. Vendors: Kong.

Quick answers

Is CVE-2026-15228 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15228 being exploited in the wild.
How severe is CVE-2026-15228?
Informational severity, with a CVSS score of 7.1, published 29 July 2026.
Which products and versions are affected?
Kong Kubernetes Ingress Controller <= 3.5.10, <= 3.4.17.
Is there a fix for CVE-2026-15228?
A patch was published on 2026-07-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15228 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-15228?
Check whether you run Kong Kubernetes Ingress Controller at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Kong Kubernetes Ingress Controller (KIC) stems from how it collects CA-certificate Secrets across watched namespaces. KIC uses a label selector (konghq.com/ca-cert=true) without enforcing ingress-class or namespace restrictions, and it derives the CA-certificate primary key (ID) directly from a user-supplied field in the Secret. An attacker with namespace-scoped permissions can create a Secret with a duplicate ID, causing the Kong Gateway to reject the entire declarative configuration document. This results in a cluster-wide denial of service for configuration updates, halting all pending changes to routes, services, and plugins. The issue is fixed in versions 3.4.18 and 3.5.11 by implementing per-object translation failure handling instead of rejecting the full configuration push.

Affected products

  • Kong kubernetes-ingress-controller <= 3.5.10, <= 3.4.17

Timeline

  • 2026-07-29: advisory
  • 2026-07-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.