Kong Ingress Controller CVE-2026-15228

Requires an authenticated principal (PR:L) with namespace-scoped Kubernetes RBAC permission to create a Secret in at least one watched namespace, and that Secret must carry the label KIC uses to select CA-certificate Secrets with a user-supplied CA-certificate ID field set to a value duplicating an ID already present in another namespace. The deployment must run Kong Ingress Controller watching multiple namespaces and consuming CA-certificate Secrets. Limiting factors: it is exploitable only in multi-tenant or delegated-namespace clusters where Secret-create is granted to less-trusted users; it has no effect where the attacker already controls all ingress, and hardened RBAC that withholds CA-labeled Secret creation from tenants blocks it entirely. Impact is availability-only (no data disclosure or config tampering beyond denial).

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 (High) and cleanly matches the description: network-reachable Kubernetes API, low attack complexity, low privileges (a namespace-scoped Secret create right), no user interaction, and a pure availability impact with no confidentiality or integrity loss. There is no EPSS score, no POC, and no KEV listing in the provided data, so real-world exploitation pressure is currently unquantified - but the barrier is genuinely low for any multi-tenant cluster because the only prerequisite (create a Secret in one's own namespace) is a routine, commonly delegated permission. The primary caveat is the tenancy model of the vector: the collision impact reaches beyond the attacker's own namespace to the whole cluster, which arguably warrants a scope/subsequent-system change that the vendor vector encodes only as VA:H. Net: a real availability priority for shared/multi-tenant Kubernetes clusters running KIC, and a low priority for single-tenant clusters where the actor already controls all ingress.

A developer with delegated rights to create Secrets only within their own application namespace crafts a CA-certificate Secret carrying the label KIC selects on and sets the user-controlled ID field to a value that duplicates an existing CA-certificate ID from another namespace. KIC aggregates both across namespace boundaries, emits a config with duplicate CA-certificate IDs, and Kong Gateway rejects the whole document - freezing all ingress updates cluster-wide. No public exploit code was identified, but the technique requires only a single crafted Secret and no special tooling.