CVE-2026-15228: Kong Ingress Controller DoS Vulnerability

CVE-2026-15228 Overview

CVE-2026-15228 affects the Kong Kubernetes Ingress Controller (KIC), enabling a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using only a label selector, without ingress-class or namespace restrictions. The CA-certificate primary key derives from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document, halting all ingress changes cluster-wide. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A tenant with Secret-create permission in a single namespace can freeze ingress configuration updates across the entire Kubernetes cluster.

Affected Products

Kong Kubernetes Ingress Controller (KIC)
Kong Gateway (downstream configuration consumer)
Multi-tenant Kubernetes clusters using KIC for ingress management

Discovery Timeline

2026-07-29 - CVE-2026-15228 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-15228

Vulnerability Analysis

The Kong Kubernetes Ingress Controller watches Secrets across all namespaces that match a configured label selector. Secrets labeled as CA certificates are aggregated into a single Kong Gateway configuration document. KIC does not enforce ingress-class filtering or namespace-scoping on this collection path. Any user with permission to create Secrets in any watched namespace can therefore inject CA-certificate entries into the global configuration set.

The controller derives each CA-certificate's primary key from a user-supplied field inside the Secret rather than from a controller-generated identifier. When two Secrets produce the same primary key, Kong Gateway detects a duplicate ID and rejects the full configuration document. The rejection is not partial: no ingress changes propagate anywhere in the cluster until the collision is resolved.

Root Cause

The root cause is missing tenant isolation combined with untrusted key derivation. KIC treats a label-selected Secret as authoritative CA-certificate input without validating uniqueness constraints or restricting the source namespace. Because the primary key comes from a mutable, user-controlled field, an attacker can deliberately clone an existing CA-certificate identifier and trigger a global configuration reload failure.

Attack Vector

An authenticated Kubernetes user with create permission on Secrets in a namespace watched by KIC creates a Secret carrying the CA-certificate label and a colliding identifier field. KIC ingests the Secret, submits the configuration to Kong Gateway, and the gateway rejects the document. All subsequent ingress updates cluster-wide are blocked until an administrator removes the offending Secret. The attack requires low privileges and no user interaction, and is exploitable over the network via the Kubernetes API. Refer to the Kong Security Advisory GHSA-g9h6-h2xj-mf78 for vendor technical details.

Detection Methods for CVE-2026-15228

Indicators of Compromise

Kong Gateway configuration reload failures citing duplicate CA-certificate IDs or unique constraint errors
KIC controller logs reporting configuration sync failures immediately after a Secret create event
New CA-certificate labeled Secrets appearing in tenant namespaces not previously associated with ingress operations
Stalled ingress reconciliation events across multiple namespaces after a single Secret creation

Detection Strategies

Audit Kubernetes API server logs for create operations on Secrets carrying the CA-certificate label selector used by KIC
Correlate Secret creation events with Kong Gateway configuration push failures within the same time window
Alert on non-administrative service accounts creating CA-certificate Secrets outside expected namespaces

Monitoring Recommendations

Ship KIC controller and Kong Gateway logs to a centralized platform and alert on repeated admin API rejection errors
Monitor ingress reconciliation lag and set thresholds that page on-call when cluster-wide updates stall
Track the count of CA-certificate Secrets per namespace and flag statistical outliers

How to Mitigate CVE-2026-15228

Immediate Actions Required

Upgrade Kong Kubernetes Ingress Controller to the fixed release identified in GHSA-g9h6-h2xj-mf78
Restrict Secret creation privileges in KIC-watched namespaces to trusted administrators using Kubernetes RBAC
Review existing CA-certificate labeled Secrets across the cluster and remove any created by untrusted principals

Patch Information

Kong has published a security advisory at GHSA-g9h6-h2xj-mf78 describing the fixed versions. The fix enforces ingress-class and namespace scoping on CA-certificate Secret collection and hardens primary-key derivation to prevent user-controlled collisions.

Workarounds

Configure KIC with an explicit --ingress-class filter and namespace restrictions to reduce the set of watched Secrets
Apply Kubernetes admission policies (OPA Gatekeeper or Kyverno) that block non-administrative creation of Secrets carrying the KIC CA-certificate label
Deploy separate KIC instances per tenant boundary so a single tenant cannot influence configuration across the cluster

bash

# Example Kyverno policy fragment restricting CA-certificate Secret creation
# Replace label key/value with the selector configured in your KIC deployment
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-kong-ca-secrets
spec:
  validationFailureAction: Enforce
  rules:
    - name: block-untrusted-ca-secrets
      match:
        any:
          - resources:
              kinds: ["Secret"]
              selector:
                matchLabels:
                  konghq.com/ca-cert: "true"
      exclude:
        any:
          - subjects:
              - kind: Group
                name: system:cluster-admins
      validate:
        message: "CA-certificate Secrets may only be created by cluster administrators."
        deny: {}