CVE-2026-15228

Received Received - Intake

Kong Kubernetes Ingress Controller CA Certificate DoS

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Kong

Description

Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-15228

Affected Vendors & Products

Vendor	Product	Version / Range
kong	kubernetes_ingress_controller	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all namespaces using only a label selector, without namespace or ingress-class restrictions. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration, halting all ingress changes cluster-wide.

Detection Guidance

To detect this vulnerability, check for duplicate CA-certificate IDs in Secrets across namespaces. Inspect Secrets labeled for Kong Gateway with duplicate IDs using kubectl commands like kubectl get secrets --all-namespaces -l konghq.com/ca-cert=true. Review Kong Gateway logs for configuration rejection errors indicating duplicate IDs.

Impact Analysis

An attacker with namespace-scoped Secret creation privileges could create conflicting CA-certificate Secrets, causing Kong Gateway to reject all ingress configurations. This results in a complete denial of service for all ingress traffic across the cluster, disrupting services dependent on ingress routing.

Compliance Impact

This vulnerability could lead to service disruptions, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Downtime may impact data processing or access, leading to compliance violations if not addressed promptly.

Mitigation Strategies

Restrict Secret creation privileges to trusted users only. Ensure CA-certificate Secrets are validated for unique IDs before deployment. Monitor Kong Gateway configuration rejections and ingress changes to detect anomalies.

Hi! I’m here to help you understand CVE-2026-15228. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70