CVE-2026-16543 Overview
CVE-2026-16543 affects the Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC). A user with namespace-scoped Secret creation privileges can trigger a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using only a label selector. It does not apply ingress-class or namespace restrictions during collection.
The CA-certificate primary key derives from a user-supplied field in the Secret. An attacker who creates a Secret with a duplicate CA-certificate identifier causes Kong Gateway to reject the entire configuration document. This halts all ingress changes across the cluster. The weakness is tracked under [CWE-400] Uncontrolled Resource Consumption.
Critical Impact
A single namespace-scoped user can block ingress configuration updates across every namespace managed by the Kong Operator, disrupting service delivery cluster-wide.
Affected Products
- Kong Operator with embedded Kong Kubernetes Ingress Controller (KIC)
- Kong Gateway deployments managed by the affected Kong Operator
- Kubernetes clusters using Kong Operator for ingress management
Discovery Timeline
- 2026-07-29 - CVE-2026-16543 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-16543
Vulnerability Analysis
The embedded KIC inside Kong Operator watches Secrets across all namespaces to build the CA-certificate list used by Kong Gateway. It filters Secrets using a label selector only. It does not scope the selection by ingress class or by an allow-list of namespaces.
When KIC assembles the Kong Gateway configuration document, it uses a user-supplied field from each matching Secret as the primary key for the CA-certificate entry. If two Secrets produce the same identifier, Kong Gateway treats the resulting document as invalid. Kong Gateway then rejects the entire document rather than the specific conflicting entries.
The rejection blocks propagation of all subsequent ingress configuration changes. Legitimate ingress objects, TLS updates, and route changes cannot be applied while the duplicate persists. The attacker requires only Secret creation permission in one watched namespace to disrupt ingress in every namespace.
Root Cause
The root cause is missing tenancy isolation in the KIC Secret watcher. The controller trusts label-selected Secrets from any namespace as authoritative CA-certificate sources. It also derives the primary key from user-controlled Secret data without validating uniqueness or namespace scope before submitting the configuration to Kong Gateway.
Attack Vector
An authenticated user with create permission on Secret objects in any KIC-watched namespace applies a Secret bearing the KIC CA-certificate label. The Secret contains a CA-certificate identifier that collides with an existing entry. KIC ingests the Secret, generates a configuration document with duplicate CA-certificate IDs, and pushes it to Kong Gateway. Kong Gateway rejects the document, and all further ingress reconciliation stalls until an administrator locates and removes the offending Secret. See the Kong Security Advisory GHSA-h4fh-j7xg-vwcx for vendor details.
Detection Methods for CVE-2026-16543
Indicators of Compromise
- Kong Gateway logs reporting configuration document rejection due to duplicate CA-certificate identifiers.
- KIC controller logs showing repeated failed synchronization attempts with the Kong Gateway admin API.
- New Secret objects created in unexpected namespaces carrying the CA-certificate label selector.
- A sudden halt of ingress, route, or TLS updates across multiple namespaces after a Secret create event.
Detection Strategies
- Audit Kubernetes API server logs for create events on Secret resources that match the KIC CA-certificate label selector.
- Correlate KIC sync failure events with recent Secret creations across all watched namespaces.
- Alert on Kong Gateway /status or admin API responses that indicate configuration document rejection.
- Compare the set of CA-certificate identifiers produced by KIC against a known-good baseline to detect collisions early.
Monitoring Recommendations
- Ingest Kubernetes audit logs and Kong Operator controller logs into a centralized data lake for correlation.
- Monitor RBAC bindings that grant Secret creation rights in namespaces watched by the Kong Operator.
- Track the rate of ingress reconciliation errors and set thresholds that trigger investigation when reconciliation stalls cluster-wide.
How to Mitigate CVE-2026-16543
Immediate Actions Required
- Upgrade Kong Operator to a fixed release as identified in the Kong Security Advisory GHSA-h4fh-j7xg-vwcx.
- Restrict Secret creation privileges to trusted service accounts and administrators in all KIC-watched namespaces.
- Inventory existing Secrets bearing the KIC CA-certificate label selector and confirm no duplicate identifiers exist.
- Enforce namespace scoping or ingress-class filtering on the Kong Operator watcher configuration where supported.
Patch Information
Refer to the vendor advisory at Kong/kong-operator GHSA-h4fh-j7xg-vwcx for fixed versions and upgrade guidance. Apply the patched Kong Operator release across all managed clusters and validate that KIC now scopes Secret collection appropriately.
Workarounds
- Configure the Kong Operator to watch a limited set of trusted namespaces rather than all namespaces where feasible.
- Apply Kubernetes admission policies (for example, OPA Gatekeeper or Kyverno) that block creation of Secrets bearing the KIC CA-certificate label from untrusted namespaces or users.
- Tighten RBAC so that only cluster operators can create Secrets carrying the label selector consumed by KIC.
- Use resource quotas and namespace policies to constrain which principals can introduce CA-certificate Secrets.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
