Junglewise Threat Intelligence
Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint
Severity: medium · CVSS 4 · Published 2026-05-19
Technologies: github.com/kong/kubernetes-ingress-controller/v3 (Go), github.com/kong/kubernetes-ingress-controller/v2 (Go), github.com/kong/kubernetes-ingress-controller (Go). Vendors: Go.
Executive brief
Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint
Affected products
- Go github.com/kong/kubernetes-ingress-controller/v3
- Go github.com/kong/kubernetes-ingress-controller/v2
- Go github.com/kong/kubernetes-ingress-controller