Executive brief
A vulnerability in the Kong Ingress Controller for Kubernetes can expose sensitive credentials, such as API keys and database passwords, in plaintext. This occurs through a diagnostic interface that fails to properly hide secrets even when configured to do so. An attacker with access to the internal cluster network could use this information to gain unauthorized access to other services and data.
Technical details
A vulnerability (CWE-201) in Kong Ingress Controller (KIC) allows unauthorized exposure of sensitive plugin credentials via the diagnostics interface. When diagnostics are enabled, the controller fails to sanitize the 'Plugins' field in configuration dumps, even if '--dump-sensitive-config=false' is set. This causes secrets referenced via 'configFrom.secretKeyRef' to be resolved and displayed in plaintext. Because the diagnostics HTTP endpoint (default port 10256) requires no authentication, any process within the cluster network can exfiltrate these secrets. The issue is fixed in version 3.5.7 by introducing proper redaction placeholders for plugin configuration values.
Affected products
- Kong kubernetes-ingress-controller/v3 < 3.5.6
- Kong kubernetes-ingress-controller/v2 <= 2.12.8
- Kong kubernetes-ingress-controller <= 1.3.4
Timeline
- 2026-05-13: disclosed
- 2026-05-19: advisory
References
- https://api.github.com/users/bugbunny-research
- https://github.com/bugbunny-research
- https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D
- https://api.github.com/users/bugbunny-research/repos
- https://avatars.githubusercontent.com/u/262839898?v=4
- https://api.github.com/users/bugbunny-research/events%7B/privacy%7D