218 lines
12 KiB
JSON
218 lines
12 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-15228",
|
||
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Kong",
|
||
"dateReserved": "2026-07-09T10:50:51.533Z",
|
||
"datePublished": "2026-07-29T15:28:30.362Z",
|
||
"dateUpdated": "2026-07-29T15:53:22.898Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
|
||
"shortName": "Kong",
|
||
"dateUpdated": "2026-07-29T15:28:30.362Z"
|
||
},
|
||
"title": "Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-862",
|
||
"description": "CWE-862",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-400",
|
||
"description": "CWE-400",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-240",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-240 Resource Injection"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Denial of Service"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"collectionURL": "https://github.com",
|
||
"packageName": "Kong/kubernetes-ingress-controller",
|
||
"repo": "https://github.com/Kong/kubernetes-ingress-controller",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "3.4.0",
|
||
"lessThan": "3.4.18",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "3.5.0",
|
||
"lessThan": "3.5.11",
|
||
"versionType": "semver"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<p>Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.</p>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://github.com/Kong/kubernetes-ingress-controller/security/advisories/GHSA-g9h6-h2xj-mf78"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
],
|
||
"cvssV4_0": {
|
||
"attackVector": "NETWORK",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"privilegesRequired": "LOW",
|
||
"userInteraction": "NONE",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"subConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "NONE",
|
||
"subIntegrityImpact": "NONE",
|
||
"vulnAvailabilityImpact": "HIGH",
|
||
"subAvailabilityImpact": "NONE",
|
||
"exploitMaturity": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"Automatable": "NOT_DEFINED",
|
||
"Recovery": "NOT_DEFINED",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"version": "4.0",
|
||
"baseSeverity": "HIGH",
|
||
"baseScore": 7.1,
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
|
||
}
|
||
}
|
||
],
|
||
"configurations": [
|
||
{
|
||
"lang": "en",
|
||
"value": "You are affected if all of the following hold:\n\n * KIC is configured without `--watch-namespace CLI flag, causing the KIC to watch Secrets cluster-wide.\n * Your cluster hosts multiple tenants where not all users are fully trusted.\n * Untrusted users have RBAC permission to create Secrets in any namespace watched by the ControlPlane, and are not prevented from applying konghq.com/ca-cert=true labels.\n\n\nYou are not affected if:\n\n * KIC has --watch-namespace that is set to only include trusted namespaces.\n * RBAC policies prevent untrusted users from creating Secrets with the labels konghq.com/ca-cert=true in any namespace watched by KIC.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<p>You are affected if<span> </span><strong>all</strong><span> </span>of the following hold:</p><ol><li>KIC is configured without<span> </span><strong>`--watch-namespace</strong><span> </span>CLI flag, causing the KIC to watch Secrets cluster-wide.</li><li>Your cluster hosts<span> </span><strong>multiple tenants</strong><span> </span>where not all users are fully trusted.</li><li>Untrusted users have RBAC permission to<span> </span><strong>create Secrets</strong><span> </span>in any namespace watched by the<span> </span><code>ControlPlane</code>, and are not prevented from applying<span> </span><code>konghq.com/ca-cert=true</code><span> </span>labels.</li></ol><p>You are<span> </span><strong>not</strong><span> </span>affected if:</p><ul><li>KIC has<span> </span><code>--watch-namespace</code><span> </span>that is set to only include trusted namespaces.</li><li>RBAC policies prevent untrusted users from creating Secrets with the labels<span> </span><code>konghq.com/ca-cert=true</code><span> </span>in any namespace watched by KIC.</li></ul>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"workarounds": [
|
||
{
|
||
"lang": "en",
|
||
"value": "* \n\nRestrict watch scope: Set --watch-namespace (or env CONTROLLER_WATCH_NAMESPACE) to only include trusted namespaces. This prevents the embedded KIC from ingesting Secrets from untrusted namespaces.\n\n\n * \n\nRestrict Secret labeling via RBAC: Use Kubernetes RBAC to prevent untrusted users from creating or modifying Secrets with the labels konghq.com/secret=true and konghq.com/ca-cert=true. Consider using an admission webhook or OPA/Kyverno policy to enforce this label restriction.\n\n\n * \n\nAudit existing CA-cert Secrets: Inspect Secrets labeled konghq.com/ca-cert=true across all watched namespaces for unexpected or duplicate data.id values. Remove any that were not provisioned by a trusted operator.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<ol><li><p><strong>Restrict watch scope</strong>: Set<span> </span><code>--watch-namespace</code><span> </span>(or env<span> </span><code>CONTROLLER_WATCH_NAMESPACE</code>) to only include trusted namespaces. This prevents the embedded KIC from ingesting Secrets from untrusted namespaces.</p></li><li><p><strong>Restrict Secret labeling via RBAC</strong>: Use Kubernetes RBAC to prevent untrusted users from creating or modifying Secrets with the labels<span> </span><code>konghq.com/secret=true</code><span> </span>and<span> </span><code>konghq.com/ca-cert=true</code>. Consider using an admission webhook or OPA/Kyverno policy to enforce this label restriction.</p></li><li><p><strong>Audit existing CA-cert Secrets</strong>: Inspect Secrets labeled<span> </span><code>konghq.com/ca-cert=true</code><span> </span>across all watched namespaces for unexpected or duplicate<span> </span><code>data.id</code><span> </span>values. Remove any that were not provisioned by a trusted operator.</p></li></ol>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Users should upgrade to the patched version of KIC (3.4.18; 3.5.11)",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<span>Users should upgrade to the patched version of KIC (3.4.18; 3.5.11)</span>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"x_generator": {
|
||
"engine": "Vulnogram 1.0.4"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-07-29T15:53:16.091813Z",
|
||
"id": "CVE-2026-15228",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-07-29T15:53:22.898Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |