Threats tagged 'ghsa-4c7q-j33x-866w'

Kyverno versions from 1.19.1 up to but not including 1.19.2 contain a vulnerability where the Policy's context.apiCall urlPath is validated after cleaning but executed using the raw path. This allows a namespace-scoped user with Policy creation permissions to craft a urlPath containing hidden '../' segments behind '#' or '?' characters to access cluster-scoped endpoints with Kyverno's ServiceAccount privileges, effectively gaining cluster admin rights.