Threats tagged 'ghsa-xqj4-vj37-xgmh'

Kyverno versions before 1.19.2 have an authorization bypass vulnerability in the Generation Handler. This flaw allows users with create or update permissions to spoof internal labels and trigger synchronized generate policies improperly. Exploiting this, attackers can label a ConfigMap as managed by Kyverno with crafted labels to clone sensitive Secrets from restricted namespaces into their own namespace.