Threats tagged 'ghsa-p59g-p6q6-8969'

Kyverno versions from 1.16.0 up to but not including 1.19.2 contain a vulnerability where path segments in the resource argument of resource.get() and resource.post() are not properly validated. This flaw allows namespaced CEL policies to escape their namespace boundaries. An attacker with the ability to create a NamespacedValidatingPolicy can exploit this by inserting '..' segments to read and write arbitrary cluster objects via the admission controller's ServiceAccount, potentially leading to full cluster takeover.