CVE-2026-16543

Received Received - Intake

Kong Operator KIC Cluster-Wide Ingress DoS via CA Certificate

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Kong

Description

Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-16543

Affected Vendors & Products

Vendor	Product	Version / Range
kong	kong_kubernetes_ingress_controller	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide denial of service for ingress configuration. The KIC collects CA-certificate Secrets across all namespaces using only a label selector, without namespace or ingress-class restrictions. Duplicate CA-certificate IDs derived from user-supplied fields cause Kong Gateway to reject the entire configuration, halting all ingress changes cluster-wide.

Detection Guidance

Check for Secrets with duplicate CA-certificate IDs across namespaces. Use kubectl to list Secrets with the label selector used by Kong Operator and inspect their data fields for duplicate IDs.

Impact Analysis

An attacker with namespace-scoped Secret creation privileges could disrupt all ingress traffic across the Kubernetes cluster by causing Kong Gateway to reject configuration updates. This results in a complete halt to ingress changes, potentially blocking all external access to services managed by Kong.

Compliance Impact

This vulnerability could lead to service disruptions, impacting availability requirements under GDPR and HIPAA. Downtime may result in non-compliance with data access or processing timelines, potentially violating regulatory obligations for timely data handling and system reliability.

Mitigation Strategies

Restrict namespace-scoped Secret creation privileges. Implement ingress-class or namespace restrictions for CA-certificate Secret collection. Validate Secret data to prevent duplicate CA-certificate IDs before Kong Gateway processes them.

Hi! I’m here to help you understand CVE-2026-16543. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70