{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-16543", "assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "state": "PUBLISHED", "assignerShortName": "Kong", "dateReserved": "2026-07-22T09:53:31.062Z", "datePublished": "2026-07-29T15:29:03.485Z", "dateUpdated": "2026-07-29T17:57:21.328Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb", "shortName": "Kong", "dateUpdated": "2026-07-29T15:29:03.485Z" }, "title": "Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-862", "description": "CWE-862", "type": "CWE" } ] }, { "descriptions": [ { "lang": "en", "cweId": "CWE-400", "description": "CWE-400", "type": "CWE" } ] } ], "impacts": [ { "capecId": "CAPEC-240", "descriptions": [ { "lang": "en", "value": "CAPEC-240 Resource Injection" } ] }, { "descriptions": [ { "lang": "en", "value": "Denial of Service" } ] } ], "affected": [ { "collectionURL": "https://github.com", "packageName": "Kong/kong-operator", "repo": "https://github.com/Kong/kong-operator", "versions": [ { "status": "affected", "version": "2.2.0", "lessThan": "2.2.3", "versionType": "semver" }, { "status": "affected", "version": "2.1.0", "lessThan": "2.1.9", "versionType": "semver" }, { "status": "affected", "version": "0", "lessThan": "2.0.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "descriptions": [ { "lang": "en", "value": "Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.

" } ] } ], "references": [ { "url": "https://github.com/Kong/kong-operator/security/advisories/GHSA-h4fh-j7xg-vwcx" } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } } ], "configurations": [ { "lang": "en", "value": "You are affected if all of the following hold:\n\n * You are running Kong Operator with an on-prem Gateway, managed via a ControlPlane resource that uses the embedded KIC.\n * The ControlPlane is configured with spec.watchNamespaces.type: All, causing the embedded KIC to watch Secrets cluster-wide.\n * Your cluster hosts multiple tenants where not all users are fully trusted operators.\n * Untrusted users have RBAC permission to create Secrets in any namespace watched by the ControlPlane, and are not prevented from applying both the konghq.com/secret=true and konghq.com/ca-cert=true labels.\n\n\nYou are not affected if:\n\n * The ControlPlane uses spec.watchNamespaces.type: Own or a tightly scoped spec.watchNamespaces.type: List covering only namespaces whose users are all fully trusted.\n * RBAC policies prevent untrusted users from creating Secrets with the labels konghq.com/secret=true and konghq.com/ca-cert=true in any namespace watched by the ControlPlane.\n * You are using Kong Operator exclusively with Konnect-managed control planes (the vulnerability is in the embedded on-prem KIC path only).", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

You are affected if all of the following hold:

  1. You are running Kong Operator with an on-prem Gateway, managed via a ControlPlane resource that uses the embedded KIC.
  2. The ControlPlane is configured with spec.watchNamespaces.type: All, causing the embedded KIC to watch Secrets cluster-wide.
  3. Your cluster hosts multiple tenants where not all users are fully trusted operators.
  4. Untrusted users have RBAC permission to create Secrets in any namespace watched by the ControlPlane, and are not prevented from applying both the konghq.com/secret=true and konghq.com/ca-cert=true labels.

You are not affected if:

" } ] } ], "workarounds": [ { "lang": "en", "value": "1. Restrict ControlPlane watch scope: Change spec.watchNamespaces.type from All to Own or a narrowly defined List that covers only namespaces whose users are trusted operators. This prevents the embedded KIC from ingesting Secrets from untrusted namespaces.2. Restrict Secret labeling via RBAC: Use Kubernetes RBAC to prevent untrusted users from creating or modifying Secrets with the labels konghq.com/secret=true and konghq.com/ca-cert=true. Consider using an admission webhook or OPA/Kyverno policy to enforce this label restriction.\n\n\n3. Audit existing CA-cert Secrets: Inspect Secrets labeled konghq.com/ca-cert=true across all watched namespaces for unexpected or duplicate data.id values. Remove any that were not provisioned by a trusted operator.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "1. Restrict ControlPlane watch scope: Change spec.watchNamespaces.type from All to Own or a narrowly defined List that covers only namespaces whose users are trusted operators. This prevents the embedded KIC from ingesting Secrets from untrusted namespaces.
2. Restrict Secret labeling via RBAC: Use Kubernetes RBAC to prevent untrusted users from creating or modifying Secrets with the labels konghq.com/secret=true and konghq.com/ca-cert=true. Consider using an admission webhook or OPA/Kyverno policy to enforce this label restriction.
3. Audit existing CA-cert Secrets: Inspect Secrets labeled konghq.com/ca-cert=true across all watched namespaces for unexpected or duplicate data.id values. Remove any that were not provisioned by a trusted operator.
" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to the patched version of Kong Operator: 2.2.3, 2.1.9 or 2.0.11.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "Upgrade to the patched version of Kong Operator: 2.2.3, 2.1.9 or 2.0.11." } ] } ], "source": { "discovery": "INTERNAL" }, "x_generator": { "engine": "Vulnogram 1.0.4" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-07-29T17:57:12.581830Z", "id": "CVE-2026-16543", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T17:57:21.328Z" } } ] } }