Threats tagged 'ghsa-rgfv-hhgv-g9h3'

Kyverno versions prior to 1.19.2 contain an authorization bypass vulnerability that allows namespaced tenants to create resources of any kind in any namespace by exploiting variable templating in generate rules. This flaw enables attackers to create policies and trigger ConfigMaps in their own namespaces, causing the privileged background-controller to write sensitive resources such as NetworkPolicies or RoleBindings into other namespaces, including kube-system.