Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument

Summary

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.

Remediation

1. Inventory every kyverno kyverno deployment, including staging.
2. Upgrade kyverno kyverno to 1.19.2.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2
• Advisoryhttps://www.vulncheck.com/advisories/kyverno-1.16.0-before-1.19.2-path-traversal-in-namespaced-cel-policies-via-resource-argument