Threats tagged 'ghsa-m6w5-f9j8-9pjp'

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace tenants to overwrite resources in other namespaces by exploiting the NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can craft a CEL map literal that fabricates a target with a chosen metadata.namespace, enabling the privileged background controller to overwrite sensitive cluster-wide resources such as Secrets, Deployments, or policies.