CVE-2026-42541: CWE-862: Missing Authorization in kubewarden kubewarden-controller
Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions (which isn't the default) can craft a policy that makes use of the can_i host callback. The callback issues a SubjectAccessReview (SAR) requests to enumerate RBAC permissions of any user or service account across the cluster.can_i does not perform that check to enforce the context-aware allow-list and forwards the request directly to the callback handler, which executes a real SubjectAccessReview using policy-server privileges. This creates a policy-level authorization gap: can_i is effectively usable even when the policy has no context-aware resource grant. This is an information disclosure / reconnaissance issue, and not direct workload data exfiltration. The attacker learns permission information, such as whether specific service accounts can "get secrets", "create pods", or "bind clusterroles" in chosen namespaces. This vulnerability is fixed in .
AI Analysis
Technical Summary
Kubewarden-controller prior to version 1.35.0 contains a missing authorization vulnerability (CWE-862) in the can_i host callback. Attackers with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions can craft policies that invoke the can_i callback, which issues SubjectAccessReview requests without enforcing context-aware allow-lists. This results in the callback executing with policy-server privileges, enabling enumeration of RBAC permissions cluster-wide. The vulnerability exposes permission details such as the ability to get secrets, create pods, or bind cluster roles in namespaces. This is an information disclosure vulnerability fixed in version 1.35.0.
Potential Impact
An attacker with elevated AdmissionPolicy or AdmissionPolicyGroup create permissions can enumerate RBAC permissions of any user or service account in the Kubernetes cluster. This information disclosure can aid in reconnaissance but does not directly lead to workload data exfiltration or integrity compromise. The CVSS score is 4.3 (medium severity), reflecting the limited impact confined to information disclosure.
Mitigation Recommendations
A fix for this vulnerability is available in kubewarden-controller version 1.35.0. Users should upgrade to version 1.35.0 or later to remediate this issue. No vendor advisory content was provided to indicate alternative mitigations or that no action is required. Therefore, upgrading is the recommended remediation.
CVE-2026-42541: CWE-862: Missing Authorization in kubewarden kubewarden-controller
Description
Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions (which isn't the default) can craft a policy that makes use of the can_i host callback. The callback issues a SubjectAccessReview (SAR) requests to enumerate RBAC permissions of any user or service account across the cluster.can_i does not perform that check to enforce the context-aware allow-list and forwards the request directly to the callback handler, which executes a real SubjectAccessReview using policy-server privileges. This creates a policy-level authorization gap: can_i is effectively usable even when the policy has no context-aware resource grant. This is an information disclosure / reconnaissance issue, and not direct workload data exfiltration. The attacker learns permission information, such as whether specific service accounts can "get secrets", "create pods", or "bind clusterroles" in chosen namespaces. This vulnerability is fixed in .
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/kubewarden/adm-controllerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kubewarden-controller prior to version 1.35.0 contains a missing authorization vulnerability (CWE-862) in the can_i host callback. Attackers with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions can craft policies that invoke the can_i callback, which issues SubjectAccessReview requests without enforcing context-aware allow-lists. This results in the callback executing with policy-server privileges, enabling enumeration of RBAC permissions cluster-wide. The vulnerability exposes permission details such as the ability to get secrets, create pods, or bind cluster roles in namespaces. This is an information disclosure vulnerability fixed in version 1.35.0.
Potential Impact
An attacker with elevated AdmissionPolicy or AdmissionPolicyGroup create permissions can enumerate RBAC permissions of any user or service account in the Kubernetes cluster. This information disclosure can aid in reconnaissance but does not directly lead to workload data exfiltration or integrity compromise. The CVSS score is 4.3 (medium severity), reflecting the limited impact confined to information disclosure.
Mitigation Recommendations
A fix for this vulnerability is available in kubewarden-controller version 1.35.0. Users should upgrade to version 1.35.0 or later to remediate this issue. No vendor advisory content was provided to indicate alternative mitigations or that no action is required. Therefore, upgrading is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-28T16:56:50.190Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a036fcccbff5d86100cc540
Added to database: 05/12/2026, 18:22:04 UTC
Last enriched: 05/20/2026, 18:50:27 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.