github.com/kong/kubernetes-ingress-controller/v2

2 results · Clear filters · Feed

• Medium —
  GHSA-m23h-6mwm-39m8

  Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

  ## Summary A vulnerability in the Kong Ingress Controller (KIC) allows for the unauthorized exfiltration of TLS certificates and private keys across Kubernetes namespace boundaries. In "managed" mode (where the `GatewayClass` lacks an unmanaged annotation), t…

  github.com/kong/kubernetes-ingress-controller github.com/kong/kubernetes-ingress-controller/v2 github.com/kong/kubernetes-ingress-controller/v3 Go
  May 19, 2026
• Medium —
  GHSA-3278-c88v-xrh4

  Kong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint

  ## Summary A vulnerability in the Kong Ingress Controller (KIC) allows for the unauthorized exposure of sensitive plugin credentials through the diagnostics interface. Even when configured to redact sensitive information (using `--dump-sensitive-config=false`…

  github.com/kong/kubernetes-ingress-controller/v2 github.com/kong/kubernetes-ingress-controller/v3 github.com/kong/kubernetes-ingress-controller Go
  May 19, 2026