Threats tagged 'ghsa-p456-76q8-jj5q'

Kyverno versions prior to 1.19.2 have a critical privilege escalation vulnerability. This flaw allows namespace administrators to create resources beyond their assigned RBAC permissions. The issue arises because generate-rule admission checks validate the controller's permissions instead of the resource author's. Consequently, attackers can craft namespaced Policies with generate rules that target other namespaces or cluster-scoped resources, causing the background controller to create or clone resources across the cluster.