Privilege Escalation in Kyverno via RBAC Bypass

Executive Summary

Kyverno before 1.19.2 has a privilege escalation vulnerability where namespace admins can create resources beyond their RBAC scope. The generate-rule admission checks incorrectly verify the controller's permissions instead of the author's, allowing attackers to craft policies that make the background controller create or clone resources cluster-wide.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Kyverno versions before 1.19.2 using commands like 'kyverno version' or 'kubectl get deployment -n kyverno kyverno -o jsonpath='{.spec.template.spec.containers[0].image}''. Review policies with generate rules targeting other namespaces or cluster-scoped resources. Inspect admission controller logs for unauthorized resource creation attempts.

Useful 0 Not Useful 0

Impact Analysis

If you use Kyverno versions before 1.19.2, a namespace admin could exploit this to create or modify resources across the entire cluster, bypassing intended access controls. This could lead to unauthorized access, data breaches, or disruption of services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data or resources. GDPR and HIPAA require strict access controls and auditability; privilege escalation risks undermine these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. Audit existing policies for generate rules targeting unintended namespaces or cluster-scoped resources. Remove or restrict namespace admin permissions to create policies. Monitor for unauthorized resource creation in logs.

Useful 0 Not Useful 0