Threats tagged 'ghsa-h448-wvj6-xqpr'

Kyverno versions prior to 1.19.2 have a policy bypass vulnerability in the admissionpolicygenerator controller. This flaw allows users with namespaced create rights on PolicyExceptions to inject negated matchConditions into generated ValidatingAdmissionPolicies, bypassing cluster-wide policy enforcement. The vulnerability arises because the controller folds PolicyExceptions into generated policies while ignoring certain gates like --enablePolicyException, --exceptionNamespace, and policy kind gates.