Kyverno Authorization Bypass via NamespacedMutatingPolicy

Executive Summary

This is an authorization bypass in Kyverno versions 1.17.0 to 1.19.1 that allows namespace tenants to overwrite resources in other namespaces. Attackers exploit the NamespacedMutatingPolicy feature by crafting a malicious CEL map literal to fabricate a target with a chosen metadata.namespace value. This forces the privileged background controller to overwrite critical resources like Secrets, Deployments, or policies cluster-wide.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by checking Kyverno versions between 1.17.0 and 1.19.1. Use commands like 'kyverno version' or inspect deployment manifests for version tags. Review NamespacedMutatingPolicy resources for suspicious targetMatchConstraints.expression fields that may contain CEL map literals fabricating namespaces.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access to a namespace could overwrite sensitive resources in other namespaces or cluster-wide. This includes Secrets, Deployments, or policies, potentially leading to data breaches, service disruptions, or unauthorized access. The impact depends on the resources targeted and the attacker's goals.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected Kyverno versions may face compliance violations, data breaches, and potential regulatory penalties if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. Restrict creation permissions for NamespacedMutatingPolicy resources to trusted users only. Review and narrow the background controller's ClusterRole grants to limit privileged operations.

Useful 0 Not Useful 0