Threats tagged 'ghsa-w3hj-rrr2-7gpp'

Kyverno versions from 1.17.0 up to but not including 1.19.2 have a missing authorization vulnerability in the mutate-existing background processor. This flaw allows namespaced tenants to modify resources outside their own namespace by creating a NamespacedMutatingPolicy targeting Namespace objects or resources in other namespaces. Exploitation can lead to the background-controller ServiceAccount stripping Pod Security labels cluster-wide.