GO-2026-5485

Medium

Advisory

Published 19 May 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.9; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1; of 17,781 indexed, latest versions
Container images: 1; deployed by those charts
Fix available: 1 of 1; affected package

Kong Ingress Controller for Kubernetes (KIC): Cross-namespace TLS Secret Exfiltration in Gateways with GatewayClass missing `konghq.com/gatewayclass-unmanaged: 'true'` annotation

Carried by container images the latest versions of 1 of 17,781 indexed charts deploy, on 1 image.

Affected package	Affected versions	Fixed in	Images
github.com/kong/kubernetes-ingress-controller/v3golang	v3.4.5-0.20250429100021-0d3e891290a8	3.4.14	1

OSV records: GHSA-m23h-6mwm-39m8 GO-2026-5485

Charts affected

1 by stars

Chart

Latest

Affected images

Radar Score

gateway-operatorkong

0.6.1

1 of 1 See more

gateway-operator kong 0.6.1

1 of the 1 container images this version deploys carry GO-2026-5485.

Container image	Digest	Package	Fixed in
kong/gateway-operator :1.6	03510967482b	github.com/kong/kubernetes-ingress-controller/v3@v3.4.5-0.20250429100021-0d3e891290a8	3.4.14

Open the chart page →

842

Container images carrying it

1 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
kong/gateway-operator :1.6	03510967482b	github.com/kong/kubernetes-ingress-controller/v3@v3.4.5-0.20250429100021-0d3e891290a8 github.com/kong/kubernetes-ingress-controller/v3@v3.4.5-0.20250429100021-0d3e891290a8	3.4.14 3.4.14	1