Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath

Summary

Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # or ? to reach cluster-scoped endpoints with Kyverno's ServiceAccount, gaining cluster admin.

Remediation

1. Inventory every kyverno kyverno deployment, including staging.
2. Upgrade kyverno kyverno to 1.19.2.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4
• Advisoryhttps://www.vulncheck.com/advisories/kyverno-1.19.1-before-1.19.2-privilege-escalation-via-policy-apicall-urlpath