Threats tagged 'ghsa-xvrq-w385-5mfv'

Kyverno versions from 1.19.1 up to but not including 1.19.2 contain an authorization bypass vulnerability in the apiCall namespace clamp. This flaw allows namespace tenants to issue cross-namespace and cluster-scoped API requests by exploiting malformed percent-escapes in the urlPath. Attackers can create namespaced Policies that run apiCall as the admission-controller ServiceAccount, enabling them to read resources in other namespaces and create mutating webhooks, potentially escalating privileges to cluster admin.