GHSA-39w8-hv5g-f73w: Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass
Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers can create namespaced Policies whose apiCall runs as the admission-controller ServiceAccount to read other namespaces' resources and create mutating webhooks, escalating to cluster admin.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A namespace tenant who can create namespaced Kyverno Policies can exploit it. The attacker does not need user interaction and can send the crafted request over the network.
What access can exploitation provide?
The crafted apiCall executes using the admission-controller ServiceAccount, allowing cross-namespace and cluster-scoped API requests. An attacker can read resources in other namespaces and create mutating webhooks, which can lead to cluster-admin privileges.
Which versions are affected?
Kyverno 1.19.1 is affected; the issue is fixed in 1.19.2. The provided advisory describes the affected range as versions from 1.19.1 before 1.19.2.