{"id":"GHSA-m23h-6mwm-39m8","aliases":["GO-2026-5485"],"status":"published","title":"Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation","description":"## Summary\n\nA vulnerability in the Kong Ingress Controller (KIC) allows for the unauthorized exfiltration of TLS certificates and private keys across Kubernetes namespace boundaries. In \"managed\" mode (where the `GatewayClass` lacks an unmanaged annotation), the Gateway TLS translator skips critical status checks. This bypass allows the translator to fetch Secrets from any namespace KIC watches, even when a `ReferenceGrant` explicitly denies access or is missing.\n\nAn actor with RBAC permissions to create or modify Gateways in a low-privileged namespace can reference a Secret in a high-privileged namespace, causing KIC to \"leak\" that Secret's sensitive private key material into the Kong dataplane configuration.\n\n## Am I affected?\n\nYou are affected if all of these hold:\n1. You are using Kong Ingress Controller with the **Gateway API**.\n2. Your `GatewayClass` is operating in **managed mode** (default behavior, no unmanaged annotation).\n3. KIC is configured to **watch multiple namespaces** (multi-tenant environment).\n4. Users have RBAC permissions to `create` or `update` `gateways.gateway.networking.k8s.io` in their own namespaces.\n\nYou are not affected if any of this:\n- You only use KIC for `Ingress` resources (not Gateway API).\n- Your `GatewayClass` uses the `konghq.com/gateway-unmanaged` annotation.\n- KIC is restricted via RBAC or configuration to only watch a single namespace.\n- You have strictly limited Gateway creation/modification permissions to trusted cluster administrators only.\n\n## Mitigation\n\n1. **Add unmanaged gateway annotation**: add the `konghq.com/gateway-unmanaged` annotation to your `GatewayClass`\n\n### Additional best practicies\n\n1. **Restrict Gateway RBAC**: Limit the ability to create or modify Gateway resources to high-trust administrative users until a patch is applied.\n2. **Namespace Isolation**: If possible, limit the namespaces KIC is permitted to watch using the `WATCH_NAMESPACE` environment variable or specific RBAC RoleBindings.\n\n## Fix\n\nThe fix mandates `ReferenceGrant` validation for all cross-namespace certificate references. By requiring a `Programmed: True` listener status, the translator now strictly authorizes external Secret access while maintaining default access for same-namespace certificates, effectively closing the exfiltration vector.\n\nFixed in [#7920](https://github.com/Kong/kubernetes-ingress-controller/pull/7920), with backports to supported release branches in [#7921](https://github.com/Kong/kubernetes-ingress-controller/pull/7921) and [#7922](https://github.com/Kong/kubernetes-ingress-controller/pull/7922).\n\nUpgrade to one of the following patched versions (or later):\n- **3.4.14**\n- **3.5.7**\n\n## CVSS\n\n`CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P` = **5.6 Medium**","severity":{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-05-19T19:30:23Z","modified":"2026-06-25T23:11:49Z","fixes":[{"ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller/v3","fixed_in":["3.5.7","3.4.14"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"last_affected":"3.5.6"},{"fixed":"3.5.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.13"},{"fixed":"3.4.14"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.12.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0"},{"fixed":"3.5.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.14"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.12.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.3.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kong/kubernetes-ingress-controller/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.14"},{"introduced":"3.5.0"},{"fixed":"3.5.7"}]}]}],"references":[{"url":"https://github.com/Kong/kubernetes-ingress-controller/security/advisories/GHSA-m23h-6mwm-39m8","tags":["web","advisory"]},{"url":"https://github.com/Kong/kubernetes-ingress-controller/pull/7920","tags":["web"]},{"url":"https://github.com/Kong/kubernetes-ingress-controller/pull/7921","tags":["web"]},{"url":"https://github.com/Kong/kubernetes-ingress-controller/pull/7922","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m23h-6mwm-39m8"},{"url":"https://github.com/Kong/kubernetes-ingress-controller","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-m23h-6mwm-39m8","title":"Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation","description":"## Summary\n\nA vulnerability in the Kong Ingress Controller (KIC) allows for the unauthorized exfiltration of TLS certificates and private keys across Kubernetes namespace boundaries. In \"managed\" mode (where the `GatewayClass` lacks an unmanaged annotation), the Gateway TLS translator skips critical status checks. This bypass allows the translator to fetch Secrets from any namespace KIC watches, even when a `ReferenceGrant` explicitly denies access or is missing.\n\nAn actor with RBAC permissions to create or modify Gateways in a low-privileged namespace can reference a Secret in a high-privileged namespace, causing KIC to \"leak\" that Secret's sensitive private key material into the Kong dataplane configuration.\n\n## Am I affected?\n\nYou are affected if all of these hold:\n1. You are using Kong Ingress Controller with the **Gateway API**.\n2. Your `GatewayClass` is operating in **managed mode** (default behavior, no unmanaged annotation).\n3. KIC is configured to **watch multiple namespaces** (multi-tenant environment).\n4. Users have RBAC permissions to `create` or `update` `gateways.gateway.networking.k8s.io` in their own namespaces.\n\nYou are not affected if any of this:\n- You only use KIC for `Ingress` resources (not Gateway API).\n- Your `GatewayClass` uses the `konghq.com/gateway-unmanaged` annotation.\n- KIC is restricted via RBAC or configuration to only watch a single namespace.\n- You have strictly limited Gateway creation/modification permissions to trusted cluster administrators only.\n\n## Mitigation\n\n1. **Add unmanaged gateway annotation**: add the `konghq.com/gateway-unmanaged` annotation to your `GatewayClass`\n\n### Additional best practicies\n\n1. **Restrict Gateway RBAC**: Limit the ability to create or modify Gateway resources to high-trust administrative users until a patch is applied.\n2. **Namespace Isolation**: If possible, limit the namespaces KIC is permitted to watch using the `WATCH_NAMESPACE` environment variable or specific RBAC RoleBindings.\n\n## Fix\n\nThe fix mandates `ReferenceGrant` validation for all cross-namespace certificate references. By requiring a `Programmed: True` listener status, the translator now strictly authorizes external Secret access while maintaining default access for same-namespace certificates, effectively closing the exfiltration vector.\n\nFixed in [#7920](https://github.com/Kong/kubernetes-ingress-controller/pull/7920), with backports to supported release branches in [#7921](https://github.com/Kong/kubernetes-ingress-controller/pull/7921) and [#7922](https://github.com/Kong/kubernetes-ingress-controller/pull/7922).\n\nUpgrade to one of the following patched versions (or later):\n- **3.4.14**\n- **3.5.7**\n\n## CVSS\n\n`CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P` = **5.6 Medium**","status":"published","published":"2026-05-19T19:30:23Z","modified":"2026-05-19T19:30:26Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:12.430932Z"}],"osv":[{"id":"GHSA-m23h-6mwm-39m8","title":"Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation","description":"## Summary\n\nA vulnerability in the Kong Ingress Controller (KIC) allows for the unauthorized exfiltration of TLS certificates and private keys across Kubernetes namespace boundaries. In \"managed\" mode (where the `GatewayClass` lacks an unmanaged annotation), the Gateway TLS translator skips critical status checks. This bypass allows the translator to fetch Secrets from any namespace KIC watches, even when a `ReferenceGrant` explicitly denies access or is missing.\n\nAn actor with RBAC permissions to create or modify Gateways in a low-privileged namespace can reference a Secret in a high-privileged namespace, causing KIC to \"leak\" that Secret's sensitive private key material into the Kong dataplane configuration.\n\n## Am I affected?\n\nYou are affected if all of these hold:\n1. You are using Kong Ingress Controller with the **Gateway API**.\n2. Your `GatewayClass` is operating in **managed mode** (default behavior, no unmanaged annotation).\n3. KIC is configured to **watch multiple namespaces** (multi-tenant environment).\n4. Users have RBAC permissions to `create` or `update` `gateways.gateway.networking.k8s.io` in their own namespaces.\n\nYou are not affected if any of this:\n- You only use KIC for `Ingress` resources (not Gateway API).\n- Your `GatewayClass` uses the `konghq.com/gateway-unmanaged` annotation.\n- KIC is restricted via RBAC or configuration to only watch a single namespace.\n- You have strictly limited Gateway creation/modification permissions to trusted cluster administrators only.\n\n## Mitigation\n\n1. **Add unmanaged gateway annotation**: add the `konghq.com/gateway-unmanaged` annotation to your `GatewayClass`\n\n### Additional best practicies\n\n1. **Restrict Gateway RBAC**: Limit the ability to create or modify Gateway resources to high-trust administrative users until a patch is applied.\n2. **Namespace Isolation**: If possible, limit the namespaces KIC is permitted to watch using the `WATCH_NAMESPACE` environment variable or specific RBAC RoleBindings.\n\n## Fix\n\nThe fix mandates `ReferenceGrant` validation for all cross-namespace certificate references. By requiring a `Programmed: True` listener status, the translator now strictly authorizes external Secret access while maintaining default access for same-namespace certificates, effectively closing the exfiltration vector.\n\nFixed in [#7920](https://github.com/Kong/kubernetes-ingress-controller/pull/7920), with backports to supported release branches in [#7921](https://github.com/Kong/kubernetes-ingress-controller/pull/7921) and [#7922](https://github.com/Kong/kubernetes-ingress-controller/pull/7922).\n\nUpgrade to one of the following patched versions (or later):\n- **3.4.14**\n- **3.5.7**\n\n## CVSS\n\n`CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P` = **5.6 Medium**","status":"published","published":"2026-05-19T19:30:23Z","modified":"2026-06-25T23:11:49.447881524Z","cvss":[{"version":"4.0","score":5.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"GO-2026-5485","title":"Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation in github.com/kong/kubernetes-ingress-controller","description":"Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation in github.com/kong/kubernetes-ingress-controller","status":"published","published":"2026-06-25T22:34:31Z","modified":"2026-06-25T23:01:02.141888639Z","updated_at":"2026-11-02T15:47:02.556545Z"}]}}