CyberRota Analysis
AI-GeneratedThe Kong Operator's embedded Kubernetes Ingress Controller (KIC) is vulnerable due to its reliance on namespace-scoped Secret creation privileges, allowing users to disrupt ingress configurations across the entire cluster. By exploiting this flaw, an attacker can create duplicate CA-certificate IDs, leading to a denial of service that halts all ingress changes. Organizations using Kubernetes with the Kong Operator should prioritize addressing this vulnerability to maintain operational integrity and prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.