Threats tagged 'ghsa-x8x2-6rxp-whpr'

Kyverno versions prior to 1.19.2 have a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces. This occurs through templating of generate.clone or cloneList namespace values, enabling an attacker to annotate a ConfigMap that triggers the background-controller to copy sensitive ConfigMaps from a victim namespace into the attacker's namespace. This results in unauthorized cross-tenant data disclosure.