Junglewise Threat Intelligence

GO-2026-5485 - Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gate

Severity: info · Published 2026-06-25

Technologies: github.com/kong/kubernetes-ingress-controller/v3 (Go), github.com/kong/kubernetes-ingress-controller/v2 (Go), github.com/kong/kubernetes-ingress-controller (Go). Vendors: Go.

Executive brief

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation in github.com/kong/kubernetes-ingress-controller

Affected products

  • Go github.com/kong/kubernetes-ingress-controller/v3
  • Go github.com/kong/kubernetes-ingress-controller/v2
  • Go github.com/kong/kubernetes-ingress-controller

Related threats