The vulnerability resides in the Kubernetes Ingress Controller’s handling of CA‑certificate Secrets. It allows a user who can create Secrets in a namespace to supply a duplicate CA‑certificate primary key. When KIC discovers two Secrets with the same data.id, the Kong Gateway rejects the full ingress configuration, resulting in a cluster-wide denial of service as all ingress updates are blocked. The flaw is based on improper input validation and lack of access control for secret labeling.

The fault affects Kong's Kubernetes Ingress Controller (KIC) versions released before the patched builds 3.4.18 and 3.5.11. Any cluster where KIC watches namespaces and processes Secrets labeled konghq.com/ca-cert=true is vulnerable if the CA‑certificate secret primary key is duplicated across namespaces.

The CVSS score of 7.1 indicates a high‑severity flaw, while an EPSS score below 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have permission to create or modify Secrets in a watched namespace and to craft a Secret with a data.id that collides with an existing CA‑certificate. Once triggered, the denial of service impacts all ingress configurations cluster‑wide, making the issue highly disruptive but limited to environments that run the affected KIC versions and have permissive Secret permissions.