Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String

Summary

Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.

Remediation

1. Inventory every kyverno kyverno deployment, including staging.
2. Upgrade kyverno kyverno to 1.19.2.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/kyverno/kyverno/commit/f67231def576eb0ad153dd8cbfc836908ab14c14
• Advisoryhttps://github.com/kyverno/kyverno/security/advisories/GHSA-pcx2-xcq4-65vf
• Advisoryhttps://www.vulncheck.com/advisories/kyverno-1.19.1-before-1.19.2-namespace-isolation-bypass-via-apicall-urlpath-query-string