Kyverno Authorization Bypass via Label Spoofing

Executive Summary

Kyverno before version 1.19.2 has an authorization bypass flaw in its Generation Handler. Users with create or update permissions can spoof internal labels like managed-by kyverno to trigger synchronized generate policies. This allows attackers to clone sensitive Secrets from restricted namespaces into their own namespace by crafting specific labels on a ConfigMap.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Kyverno versions before 1.19.2. Run: kubectl get deployment -n kyverno kyverno -o jsonpath='{.spec.template.spec.containers[0].image}' to verify the installed version. Inspect ConfigMaps with labels managed-by kyverno and generate.kyverno.io/* labels for suspicious configurations.

Useful 0 Not Useful 0

Impact Analysis

An attacker with basic Kubernetes permissions could escalate privileges and access sensitive data. They can force Kyverno to generate resources like Secrets in their namespace, bypassing namespace restrictions. This could lead to unauthorized data exposure or privilege escalation within the cluster.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Unauthorized data exposure or privilege escalation may result in regulatory penalties, loss of trust, and legal consequences for organizations failing to secure sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. Remove unnecessary generate.kyverno.io/* labels from ConfigMaps. Restrict permissions for users to prevent unauthorized label manipulation. Monitor for unauthorized Secret generation across namespaces.

Useful 0 Not Useful 0