Threats tagged 'ghsa-vhcf-rq9h-r35p'

Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace administrators to escape their namespace confinement by exploiting the cleanup controller's context loader, which is built with a nil policy. Attackers can leverage this to read Secrets across namespaces and modify validating webhook configurations using the cleanup controller's ServiceAccount.