Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy

Summary

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.

Remediation

1. Inventory every kyverno kyverno deployment, including staging.
2. Upgrade kyverno kyverno to 1.19.2.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/kyverno/kyverno/security/advisories/GHSA-jcw5-3wcg-fqx5
• Advisoryhttps://www.vulncheck.com/advisories/kyverno-1.17.0-before-1.19.2-cross-namespace-resource-overwrite-via-namespacedmutatingpolicy