Threats affecting pkg:github/kyverno/kyverno

Kyverno versions before 1.19.2 have a denial of service vulnerability in the substituteVariablesIfAny function. This flaw allows low-privileged users to cause the admission webhook to hang by creating self-referential variable templates. The attack triggers unbounded substitution loops that exhaust CPU and memory resources, blocking cluster-wide admission.

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace administrators to escape their namespace confinement by exploiting the cleanup controller's context loader, which is built with a nil policy. Attackers can leverage this to read Secrets across namespaces and modify validating webhook configurations using the cleanup controller's ServiceAccount.

Kyverno versions prior to 1.19.2 have a critical privilege escalation vulnerability. This flaw allows namespace administrators to create resources beyond their assigned RBAC permissions. The issue arises because generate-rule admission checks validate the controller's permissions instead of the resource author's. Consequently, attackers can craft namespaced Policies with generate rules that target other namespaces or cluster-scoped resources, causing the background controller to create or clone resources across the cluster.

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace tenants to overwrite resources in other namespaces by exploiting the NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can craft a CEL map literal that fabricates a target with a chosen metadata.namespace, enabling the privileged background controller to overwrite sensitive cluster-wide resources such as Secrets, Deployments, or policies.

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the workload and use mutateDigest to pin the unverified digest.

Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types, triggering a panic that disrupts admission control and policy enforcement.

Kyverno versions prior to 1.19.1 have a namespace isolation bypass vulnerability in the apiCall context entry of namespaced Policy resources. This occurs due to inconsistent path interpretation between validation and execution, allowing a low-privilege tenant to use percent-encoded dot-segments in the urlPath to bypass namespace checks. Exploitation enables reading resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials.

Kyverno versions before 1.19.1 contain a critical vulnerability in the validation of URL-encoded path segments within the Policy apiCall urlPath. This flaw allows namespace tenants to bypass namespace restrictions and create objects in other namespaces using percent-encoded directory traversal sequences. Exploitation can lead to creation of MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, resulting in privilege escalation to cluster admin.

Kyverno versions 1.16.0 through 1.19.0 have a vulnerability where the globalcontext.Lib CEL library is registered in the policy environment without namespace confinement. This allows a tenant with permission to create namespaced policies to access cached cluster-scoped global context entries, including data from namespaces they do not have RBAC permissions to read. The issue is fixed in version 1.19.1.

Kyverno versions 1.14.0 through 1.19.0 contain a vulnerability in the ImageValidatingPolicy evaluator where it fails to properly read the spec.images and spec.allowedValues fields of a PolicyException. This causes image signature verification to be skipped for all images in a matched resource when an exception is intended only for specific images, allowing unsigned or untrusted images to be admitted without verification. The issue is resolved in version 1.19.1.

Kyverno versions prior to 1.19.1 contain a server-side request forgery (SSRF) vulnerability. This issue arises because certain legacy API call paths do not enforce egress filtering or validate service URLs, allowing crafted policies or resource submitters to make Kyverno send HTTP requests to arbitrary internal or external hosts. The vulnerability can lead to unauthorized access to cloud metadata endpoints and internal services using Kyverno's network privileges. The flaw is fixed in version 1.19.1.