{"id":"GHSA-m23h-6mwm-39m8","aliases":["GO-2026-5485"],"url":"https://o3.security/vulnerability/GHSA-m23h-6mwm-39m8","summary":"Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation","details":"## Summary\n\nA vulnerability in the Kong Ingress Controller (KIC) allows for the unauthorized exfiltration of TLS certificates and private keys across Kubernetes namespace boundaries. In \"managed\" mode (where the `GatewayClass` lacks an unmanaged annotation), the Gateway TLS translator skips critical status checks. This bypass allows the translator to fetch Secrets from any namespace KIC watches, even when a `ReferenceGrant` explicitly denies access or is missing.\n\nAn actor with RBAC permissions to create or modify Gateways in a low-privileged namespace can reference a Secret in a high-privileged namespace, causing KIC to \"leak\" that Secret's sensitive private key material into the Kong dataplane configuration.\n\n## Am I affected?\n\nYou are affected if all of these hold:\n1. You are using Kong Ingress Controller with the **Gateway API**.\n2. Your `GatewayClass` is operating in **managed mode** (default behavior, no unmanaged annotation).\n3. KIC is configured to **watch multiple namespaces** (multi-tenant environment).\n4. Users have RBAC permissions to `create` or `update` `gateways.gateway.networking.k8s.io` in their own namespaces.\n\nYou are not affected if any of this:\n- You only use KIC for `Ingress` resources (not Gateway API).\n- Your `GatewayClass` uses the `konghq.com/gateway-unmanaged` annotation.\n- KIC is restricted via RBAC or configuration to only watch a single namespace.\n- You have strictly limited Gateway creation/modification permissions to trusted cluster administrators only.\n\n## Mitigation\n\n1. **Add unmanaged gateway annotation**: add the `konghq.com/gateway-unmanaged` annotation to your `GatewayClass`\n\n### Additional best practicies\n\n1. **Restrict Gateway RBAC**: Limit the ability to create or modify Gateway resources to high-trust administrative users until a patch is applied.\n2. **Namespace Isolation**: If possible, limit the namespaces KIC is permitted to watch using the `WATCH_NAMESPACE` environment variable or specific RBAC RoleBindings.\n\n## Fix\n\nThe fix mandates `ReferenceGrant` validation for all cross-namespace certificate references. By requiring a `Programmed: True` listener status, the translator now strictly authorizes external Secret access while maintaining default access for same-namespace certificates, effectively closing the exfiltration vector.\n\nFixed in [#7920](https://github.com/Kong/kubernetes-ingress-controller/pull/7920), with backports to supported release branches in [#7921](https://github.com/Kong/kubernetes-ingress-controller/pull/7921) and [#7922](https://github.com/Kong/kubernetes-ingress-controller/pull/7922).\n\nUpgrade to one of the following patched versions (or later):\n- **3.4.14**\n- **3.5.7**\n\n## CVSS\n\n`CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P` = **5.6 Medium**","published":"2026-05-19T19:30:23Z","modified":"2026-06-25T23:11:49.447881524Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/kong/kubernetes-ingress-controller/v3","fixedVersion":"3.5.7"},{"ecosystem":"Go","name":"github.com/kong/kubernetes-ingress-controller/v3","fixedVersion":"3.4.14"},{"ecosystem":"Go","name":"github.com/kong/kubernetes-ingress-controller/v2","fixedVersion":null},{"ecosystem":"Go","name":"github.com/kong/kubernetes-ingress-controller","fixedVersion":null}],"fix":{"url":"https://github.com/Kong/kubernetes-ingress-controller/pull/7920","label":"Kong/kubernetes-ingress-controller#7920"},"references":[{"type":"WEB","url":"https://github.com/Kong/kubernetes-ingress-controller/security/advisories/GHSA-m23h-6mwm-39m8"},{"type":"WEB","url":"https://github.com/Kong/kubernetes-ingress-controller/pull/7920"},{"type":"WEB","url":"https://github.com/Kong/kubernetes-ingress-controller/pull/7921"},{"type":"WEB","url":"https://github.com/Kong/kubernetes-ingress-controller/pull/7922"},{"type":"PACKAGE","url":"https://github.com/Kong/kubernetes-ingress-controller"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-25T23:11:49.447881524Z"}}