Threats tagged 'ghsa-j5qr-vw59-8jh6'

Kyverno versions from 1.19.1 up to but not including 1.19.2 contain a namespace isolation bypass vulnerability in the APICall Fetch() function. This occurs because the path.Clean function treats the '?' character as part of the path, allowing a crafted URLPath with query parameters to bypass namespace restrictions. Users with permission to create namespaced policies can exploit this to access cluster-scoped resources outside their namespace.