CVE-2026-16543: Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision
Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace restrictions. The CA-certificate primary key is derived from a user-supplied field in the Secret. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document and halting all ingress changes cluster-wide.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.1.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.11
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16543?
The severity of CVE-2026-16543 is high, with a CVSS score of 7.1.
How do I fix CVE-2026-16543?
To fix CVE-2026-16543, ensure that only trusted users have namespace-scoped Secret creation privileges.
What does CVE-2026-16543 affect?
CVE-2026-16543 affects the Kong Operator and Kong Kubernetes Ingress Controller (KIC).
What type of vulnerability is CVE-2026-16543?
CVE-2026-16543 is a denial of service vulnerability related to cluster-wide ingress configuration.
Who can exploit CVE-2026-16543?
An attacker with namespace-scoped Secret creation privileges can exploit CVE-2026-16543.