Threats tagged 'ghsa-8qwp-w9x6-mcp7'

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain a critical privilege escalation vulnerability. This flaw allows namespace-scoped tenants to modify resources in other namespaces by exploiting a lack of namespace checks in the NamespacedMutatingPolicy targetMatchConstraints.expression CEL output. Attackers can manipulate cluster-wide background controllers to mutate RoleBindings, Roles, NetworkPolicies, and ConfigMaps belonging to other tenants.