CVE-2026-15228 in Kubernetes Ingress Controller
Summary
by MITRE • 07/29/2026
Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in Kong Kubernetes Ingress Controller (KIC) represents a critical design flaw that enables privilege escalation and cluster-wide denial of service through improperly scoped secret handling mechanisms. This issue arises from KIC's approach to collecting Certificate Authority (CA) certificate secrets across all watched namespaces using only label selectors without implementing proper ingress-class or namespace restrictions. The fundamental technical flaw occurs when an attacker with namespace-scoped Secret creation privileges can create malicious secrets that collide on their primary key values, which are derived from user-supplied fields within the secret data. This vulnerability directly maps to CWE-284 Access Control Issues and aligns with ATT&CK technique T1078 Valid Accounts, as it exploits legitimate user privileges to achieve unauthorized system impact.
The operational impact of this vulnerability is severe and far-reaching, potentially affecting entire Kubernetes clusters by causing complete ingress configuration failures. When duplicate CA-certificate IDs are encountered, Kong Gateway rejects the entire configuration document rather than gracefully handling individual conflicts, resulting in a cascading failure that halts all ingress changes across the cluster. This behavior creates a denial of service condition where legitimate traffic routing configurations cannot be processed or updated, effectively cutting off access to applications and services managed through the ingress controller. The vulnerability demonstrates how improper input validation and lack of proper key uniqueness verification can create systemic failures in distributed systems.
Security implications extend beyond simple denial of service as this vulnerability enables attackers to disrupt critical infrastructure services without requiring cluster-wide privileges. The attack vector relies on minimal permissions that many legitimate users might possess, making it particularly dangerous in environments where least privilege principles are not strictly enforced. Organizations using KIC with default configurations are vulnerable to this attack, as the controller's default behavior of watching all namespaces creates an attack surface that can be exploited by users with basic namespace creation capabilities. The lack of proper namespace isolation and ingress-class filtering mechanisms means that a single malicious user can potentially compromise the entire ingress configuration for the cluster.
Mitigation strategies should focus on implementing strict access controls and input validation measures to prevent duplicate key generation. Organizations should consider restricting KIC's watch scope to specific namespaces or ingress classes using appropriate label selectors combined with namespace restrictions. Implementing proper secret validation mechanisms that check for duplicate primary keys before configuration deployment would prevent the cascading failure scenario. Additionally, configuring KIC with explicit namespace filtering and ingress-class constraints can limit the attack surface significantly. The solution should align with security best practices outlined in NIST SP 800-53 and ISO/IEC 27001 controls for access control and system integrity, ensuring that configuration management processes include proper validation and sanitization of inputs before processing.
The vulnerability highlights the importance of proper input sanitization and uniqueness verification in distributed systems. It demonstrates how seemingly benign design choices in secret handling can create systemic security risks when combined with insufficient access controls. Organizations should implement comprehensive monitoring for ingress configuration changes and establish automated alerting mechanisms to detect potential duplicate key scenarios. Regular security assessments of ingress controller configurations should include reviews of secret management practices and access control policies to prevent similar vulnerabilities from being introduced through configuration drift or improper privilege assignments. The incident underscores the need for robust input validation at all levels of system architecture, particularly in components that aggregate data from multiple sources without proper conflict resolution mechanisms.