Multiple vulnerabilities have been identified in Kyverno, an open-source policy engine for Kubernetes that validates, mutates, and generates policies as code. These issues affect versions prior to 1.19.2. A fix is available in version 1.19.2.
Kyverno versions prior to 1.19.2 contain an authorization bypass vulnerability that allows namespaced tenants to create resources of any kind in any namespace by exploiting variable templating in generate rules. This flaw enables attackers to create policies and trigger ConfigMaps in their own namespaces, causing the privileged background-controller to write sensitive resources such as NetworkPolicies or RoleBindings into other namespaces, including kube-system.
Kyverno versions from 1.11.0 up to but not including 1.19.2 contain an unbounded decompression vulnerability in the FetchSignatureBlob function. This flaw allows attackers who control registry referrers or signatures to supply highly compressed notary signature layers that decompress beyond the configured maximum payload size. Exploiting this can cause the admission controller to consume excessive memory, leading to out-of-memory (OOM) kills and denial of service.
Kyverno versions from 1.11.0 up to but not including 1.19.2 contain an unbounded decompression vulnerability in the extractStatement function. This flaw allows remote attackers to cause denial of service by exhausting memory resources through highly compressed attestation layers. Specifically, attackers controlling registry referrer artifacts can push gzip predicate layers that exceed the maximum payload size when decompressed, leading to out-of-memory (OOM) kills of the admission controller.
Kyverno versions prior to 1.19.2 have a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces. This occurs through templating of generate.clone or cloneList namespace values, enabling an attacker to annotate a ConfigMap that triggers the background-controller to copy sensitive ConfigMaps from a victim namespace into the attacker's namespace. This results in unauthorized cross-tenant data disclosure.
Kyverno versions before 1.19.2 have an unchecked type assertion vulnerability in the buildStatementMap function. This flaw allows unauthenticated attackers to crash the policy engine by submitting crafted attestation statements. Specifically, attackers can push an OCI referrer manifest containing a non-string type field, which can bypass image verification when failurePolicy is set to Ignore or cause a crash-loop in the reports-controller.
Kyverno versions from 1.17.0 up to but not including 1.19.2 have a missing authorization vulnerability in the mutate-existing background processor. This flaw allows namespaced tenants to modify resources outside their own namespace by creating a NamespacedMutatingPolicy targeting Namespace objects or resources in other namespaces. Exploitation can lead to the background-controller ServiceAccount stripping Pod Security labels cluster-wide.
Kyverno versions before 1.19.2 have a vulnerability in the variable-substitution engine where an unchecked type assertion can cause the policy engine to crash. This occurs when users submit resources with non-string fields referenced by shallow substitution in policies, leading to a panic. The resulting crash causes webhook denial of service and may allow policy bypass if failurePolicy is set to Ignore.
Kyverno versions before 1.19.2 contain an authentication bypass vulnerability in the matchCertificateData function. This flaw allows attackers with a leaf certificate from a configured private trust root to bypass verifyImages subject and subjectRegExp checks if the signing certificate lacks a Subject Alternative Name (SAN). By omitting the SAN and setting the expected Fulcio issuer OID, attackers can sign malicious images that are admitted despite signer pinning.
Kyverno versions from 1.16.0 up to but not including 1.19.2 contain a vulnerability where path segments in the resource argument of resource.get() and resource.post() are not properly validated. This flaw allows namespaced CEL policies to escape their namespace boundaries. An attacker with the ability to create a NamespacedValidatingPolicy can exploit this by inserting '..' segments to read and write arbitrary cluster objects via the admission controller's ServiceAccount, potentially leading to full cluster takeover.
Kyverno versions from 1.19.1 up to but not including 1.19.2 contain a namespace isolation bypass vulnerability in the APICall Fetch() function. This occurs because the path.Clean function treats the '?' character as part of the path, allowing a crafted URLPath with query parameters to bypass namespace restrictions. Users with permission to create namespaced policies can exploit this to access cluster-scoped resources outside their namespace.
Kyverno versions from 1.17.0 up to but not including 1.19.2 contain a critical privilege escalation vulnerability. This flaw allows namespace-scoped tenants to modify resources in other namespaces by exploiting a lack of namespace checks in the NamespacedMutatingPolicy targetMatchConstraints.expression CEL output. Attackers can manipulate cluster-wide background controllers to mutate RoleBindings, Roles, NetworkPolicies, and ConfigMaps belonging to other tenants.
Kyverno versions prior to 1.19.2 have a denial-of-service vulnerability in the In and NotIn operators. This flaw allows attackers to crash the policy engine by submitting resources that cause a panic due to unchecked type assertions when JMESPath expressions evaluate to arrays containing integers, booleans, or mixed types. The crash disrupts admission control and policy enforcement.
Kyverno versions from 1.19.1 up to but not including 1.19.2 contain a vulnerability where the Policy's context.apiCall urlPath is validated after cleaning but executed using the raw path. This allows a namespace-scoped user with Policy creation permissions to craft a urlPath containing hidden '../' segments behind '#' or '?' characters to access cluster-scoped endpoints with Kyverno's ServiceAccount privileges, effectively gaining cluster admin rights.
Kyverno versions 1.18.0 up to but not including 1.19.2 contain a vulnerability in the verifyImages function where signature verification can be bypassed. This occurs because cached verification results are keyed by image reference strings (e.g., tags) rather than the verified image digest. An attacker able to submit workloads and manipulate registry tags can exploit this to bypass signature and attestation checks, causing Kyverno to admit workloads with unverified images.
Kyverno versions prior to 1.19.2 have a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory resources. This occurs because CEL expressions are evaluated without runtime cost limits, enabling attackers to create policies with nested map comprehensions over large ConfigMap fields. Exploitation can cause Kyverno pods to be OOM-killed and block cluster-wide admission.
Kyverno versions before 1.19.2 have an authorization bypass vulnerability in the Generation Handler. This flaw allows users with create or update permissions to spoof internal labels and trigger synchronized generate policies improperly. Exploiting this, attackers can label a ConfigMap as managed by Kyverno with crafted labels to clone sensitive Secrets from restricted namespaces into their own namespace.
Kyverno versions prior to 1.19.2 have a policy bypass vulnerability in the admissionpolicygenerator controller. This flaw allows users with namespaced create rights on PolicyExceptions to inject negated matchConditions into generated ValidatingAdmissionPolicies, bypassing cluster-wide policy enforcement. The vulnerability arises because the controller folds PolicyExceptions into generated policies while ignoring certain gates like --enablePolicyException, --exceptionNamespace, and policy kind gates.
Kyverno versions prior to 1.19.2 have a denial of service vulnerability where namespaced policy authors can submit specially crafted wildcard patterns. This causes excessive CPU usage in the admission controller, leading to cluster-wide webhook timeouts that block resource operations.