Executive brief
Kong Operator, a tool used to manage Kong Gateway deployments on Kubernetes, contains a vulnerability in its embedded Ingress Controller. A user with limited permissions to create 'Secrets' in a single namespace can trigger a cluster-wide denial of service. By providing specific duplicate identifiers in these Secrets, an attacker can cause the entire Kong Gateway configuration to fail, preventing any new traffic rules or security updates from being applied across the entire organization's infrastructure.
Technical details
The vulnerability exists in the embedded Kong Kubernetes Ingress Controller (KIC) within Kong Operator. The KIC collects CA-certificate Secrets across all watched namespaces using only a label selector, failing to enforce ingress-class or namespace restrictions. Because the CA-certificate primary key (ID) is derived from a user-supplied field in the Secret, an attacker with namespace-scoped 'Secret' creation privileges can craft duplicate IDs. When Kong Gateway receives a declarative configuration containing these duplicate primary keys, it rejects the entire configuration document. This results in a cluster-wide denial of service (DoS) for all pending ingress configuration changes, including routes, plugins, and services. The issue is fixed in versions 2.2.3, 2.1.9, and 2.0.11 by implementing per-object translation failure handling instead of total configuration rejection.
Affected products
- Kong kong-operator < 2.0.11, 2.1.0 - 2.1.8, 2.2.0 - 2.2.2
Timeline
- 2026-07-29: advisory
- 2026-07-29: patched