Kong Ingress Controller sensitive information leak in diagnostics endpoint

Severity: medium · CVSS 4.9 · Published 2026-05-19

A vulnerability in the Kong Ingress Controller for Kubernetes can expose sensitive credentials, such as API keys and database passwords, in plaintext. This occurs through a diagnostic interface that fails to properly hide secrets even when configured to do so. An attacker with access to the internal cluster network could use this information to gain unauthorized access to other services and data.

Technologies: github.com/kong/kubernetes-ingress-controller (Go), github.com/kong/kubernetes-ingress-controller/v2 (Go), github.com/kong/kubernetes-ingress-controller/v3 (Go), Kong Kubernetes Ingress Controller. Vendors: Go, Kong.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 4.9, published 19 May 2026.
Which products and versions are affected?
github.com/kong/kubernetes-ingress-controller (Go) <= 1.3.4; github.com/kong/kubernetes-ingress-controller/v2 (Go) <= 2.12.8; github.com/kong/kubernetes-ingress-controller/v3 (Go) < 3.5.6.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked from the adjacent network, in a software library.
Am I affected?
Check whether you run github.com/kong/kubernetes-ingress-controller (Go), github.com/kong/kubernetes-ingress-controller/v2 (Go), github.com/kong/kubernetes-ingress-controller/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability (CWE-201) in Kong Ingress Controller (KIC) allows unauthorized exposure of sensitive plugin credentials via the diagnostics interface. When diagnostics are enabled, the controller fails to sanitize the 'Plugins' field in configuration dumps, even if '--dump-sensitive-config=false' is set. This causes secrets referenced via 'configFrom.secretKeyRef' to be resolved and displayed in plaintext. Because the diagnostics HTTP endpoint (default port 10256) requires no authentication, any process within the cluster network can exfiltrate these secrets. The issue is fixed in version 3.5.7 by introducing proper redaction placeholders for plugin configuration values.

Affected products

  • Kong kubernetes-ingress-controller/v3 < 3.5.6
  • Kong kubernetes-ingress-controller/v2 <= 2.12.8
  • Kong kubernetes-ingress-controller <= 1.3.4

Timeline

  • 2026-05-13: disclosed
  • 2026-05-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.