Skip to main content

Kong Ingress Controller CVE-2026-15228

| EUVDEUVD-2026-50353 HIGH
Missing Authorization (CWE-862)
2026-07-29 Kong
Kubernetes Denial Of Service Authentication Bypass
7.1
CVSS 4.0 · Vendor: Kong
Share

Severity by source

Vendor (Kong) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.7 HIGH

Authenticated namespace-scoped Secret creator (PR:L) over the network with low complexity; availability-only impact, and S:C because a single-namespace actor halts ingress across all other namespaces.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Kong).

CVSS VectorVendor: Kong

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 29, 2026 - 15:52 vuln.today
CVE Published
Jul 29, 2026 - 15:28 cve.org
HIGH 7.1

DescriptionCVE.org

Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.

Articles & Coverage 1

News 3 New Kubernetes Vulnerabilities - 1 Critical, 2 High, 1 With POC Jul 30, 2026

AnalysisAI

Cluster-wide ingress denial of service in Kong Kubernetes Ingress Controller (KIC) allows a tenant holding only namespace-scoped Secret creation rights to halt all ingress configuration changes across every watched namespace. Because KIC gathers CA-certificate Secrets by label selector alone - ignoring ingress-class and namespace boundaries - and derives the CA-certificate primary key from a user-supplied Secret field, a low-privileged user can create a duplicate CA-certificate ID that forces Kong Gateway to reject the entire configuration document. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain namespace-scoped Secret-create rights
Delivery
Craft CA-cert Secret with duplicate ID label
Exploit
KIC collects it cluster-wide
Execution
Kong Gateway rejects entire config
Impact
All ingress changes halted cluster-wide
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated principal (PR:L) with namespace-scoped Kubernetes RBAC permission to create a Secret in at least one watched namespace, and that Secret must carry the label KIC uses to select CA-certificate Secrets with a user-supplied CA-certificate ID field set to a value duplicating an ID already present in another namespace. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 (High) and cleanly matches the description: network-reachable Kubernetes API, low attack complexity, low privileges (a namespace-scoped Secret create right), no user interaction, and a pure availability impact with no confidentiality or integrity loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A developer with delegated rights to create Secrets only within their own application namespace crafts a CA-certificate Secret carrying the label KIC selects on and sets the user-controlled ID field to a value that duplicates an existing CA-certificate ID from another namespace. KIC aggregates both across namespace boundaries, emits a config with duplicate CA-certificate IDs, and Kong Gateway rejects the whole document - freezing all ingress updates cluster-wide. …
Remediation Upgrade Kong Ingress Controller to the fixed release identified in the vendor advisory GHSA-g9h6-h2xj-mf78 (https://github.com/Kong/kubernetes-ingress-controller/security/advisories/GHSA-g9h6-h2xj-mf78); an exact patched version was not present in the provided data, so confirm the fixed version directly from that advisory before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit your Kubernetes environment to identify whether Kong KIC is deployed and document which versions are in use; simultaneously, review RBAC policies to identify users or service accounts with namespace-scoped Secret creation permissions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Kubernetes

View all
CVE-2025-1974 CRITICAL POC
9.8 Mar 25

A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
CVE-2026-45321 CRITICAL POC
9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
CVE-2025-1098 HIGH POC
8.8 Mar 25

Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress

CVE-2025-24514 HIGH POC
8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
CVE-2025-1097 HIGH POC
8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
CVE-2020-8554 MEDIUM POC
6.3 Jan 21

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
CVE-2025-55190 CRITICAL POC
9.9 Sep 04

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
CVE-2018-18843 CRITICAL POC
10.0 Dec 04

The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
CVE-2026-54680 CRITICAL POC
9.9 Jul 29

Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
CVE-2026-22039 CRITICAL POC
9.9 Jan 27

Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
CVE-2024-42480 CRITICAL POC
9.9 Aug 12

Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem
CVE-2023-28110 CRITICAL POC
9.9 Mar 16

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-15228 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy