EUVD-2026-50394Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Namespace tenant privilege (PR:L) via the Kubernetes API (AV:N/AC:L); a scoped Secret impacts the whole gateway config, so S:C; availability-only impact makes C:N/I:N/A:H.
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.
Articles & Coverage 1
AnalysisAI
Cluster-wide ingress denial of service in Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) lets a tenant holding only namespace-scoped Secret creation rights halt all ingress configuration changes across the entire cluster. Because the embedded KIC gathers CA-certificate Secrets from every watched namespace using only a label selector - with no ingress-class or namespace scoping - an attacker can plant a Secret whose user-controlled CA-certificate ID collides with an existing one, causing Kong Gateway to reject the whole configuration document. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an attacker to hold namespace-scoped Kubernetes RBAC permission to create Secret objects in at least one namespace watched by the embedded KIC, and the deployment must use Kong Operator's embedded KIC configured to collect CA-certificate Secrets via label selector across all watched namespaces without ingress-class or namespace restriction (the vulnerable default behavior described). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H, score 7.1) is internally consistent with the description: network-reachable Kubernetes API, low complexity, low privileges (a legitimate namespace tenant), no user interaction, and an availability-only impact with no confidentiality or integrity loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer or attacker who controls a single application namespace - with only the ability to create Secrets there - crafts a CA-certificate Secret carrying the label KIC selects on and sets its user-supplied CA-certificate ID to collide with an ID already in use elsewhere in the cluster. KIC ingests it globally, Kong Gateway then rejects the entire configuration document as invalid, and all subsequent ingress/route changes across every namespace stop applying. … |
| Remediation | Consult and apply the Kong GitHub Security Advisory GHSA-h4fh-j7xg-vwcx (https://github.com/Kong/kong-operator/security/advisories/GHSA-h4fh-j7xg-vwcx) and upgrade to the fixed Kong Operator release it names - a specific patched version was not included in this data and must be taken from the advisory (do not assume a version). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately restrict Secret creation RBAC permissions within Kong-monitored namespaces to trusted administrators only, and audit current namespace-scoped Secret creation access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref
Same weakness CWE-862 – Missing Authorization
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today