CVE-2026-15228

Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace...

CVE-2026-16543

Kong Operator’s embedded Kong Kubernetes Ingress Controller (KIC) is vulnerable. A user with namespace-scoped Secret creation privileges can cause a cluster-wide denial of service by collecting CA-certificate Secrets across watched namespaces using only a label selector, with no ingress-class or ...