Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.
"}]}],"references":[{"url":"https://github.com/Kong/kubernetes-ingress-controller/security/advisories/GHSA-g9h6-h2xj-mf78"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}],"configurations":[{"lang":"en","value":"You are affected if all of the following hold:\n\n * KIC is configured without `--watch-namespace CLI flag, causing the KIC to watch Secrets cluster-wide.\n * Your cluster hosts multiple tenants where not all users are fully trusted.\n * Untrusted users have RBAC permission to create Secrets in any namespace watched by the ControlPlane, and are not prevented from applying konghq.com/ca-cert=true labels.\n\n\nYou are not affected if:\n\n * KIC has --watch-namespace that is set to only include trusted namespaces.\n * RBAC policies prevent untrusted users from creating Secrets with the labels konghq.com/ca-cert=true in any namespace watched by KIC.","supportingMedia":[{"type":"text/html","base64":false,"value":"You are affected if all of the following hold:
ControlPlane, and are not prevented from applying konghq.com/ca-cert=true labels.You are not affected if:
--watch-namespace that is set to only include trusted namespaces.konghq.com/ca-cert=true in any namespace watched by KIC.Restrict watch scope: Set --watch-namespace (or env CONTROLLER_WATCH_NAMESPACE) to only include trusted namespaces. This prevents the embedded KIC from ingesting Secrets from untrusted namespaces.
Restrict Secret labeling via RBAC: Use Kubernetes RBAC to prevent untrusted users from creating or modifying Secrets with the labels konghq.com/secret=true and konghq.com/ca-cert=true. Consider using an admission webhook or OPA/Kyverno policy to enforce this label restriction.
Audit existing CA-cert Secrets: Inspect Secrets labeled konghq.com/ca-cert=true across all watched namespaces for unexpected or duplicate data.id values. Remove any that were not provisioned by a trusted operator.