Kong Operator’s embedded Kong Kubernetes Ingress Controller (KIC) gathers CA‑certificate Secrets from all watched namespaces using only a label selector, ignoring ingress‑class or namespace constraints. The CA‑certificate primary key is derived from a field supplied by the user in the Secret. Duplicate CA‑certificate IDs cause the Kong Gateway to reject the entire configuration document, halting all ingress changes cluster‑wide. This vulnerability can be exploited to cause a denial‑of‑service for ingress configuration.

Kong Operator, all versions prior to the patched releases 2.2.3, 2.1.9, and 2.0.11.

The CVSS score of 7.1 indicates a high‑impact issue, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user who can create Secrets labeled konghq.com/secret=true and konghq.com/ca-cert=true in a watched namespace. By creating duplicate CA‑certificate IDs, such a user can trigger the Kong Gateway to reject ingress configuration and cause a cluster‑wide denial of service. The attack is an insider privilege escalation scenario where the attacker only needs namespace‑scoped Secret creation rights.