Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy

Summary

Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target such as another tenant's RoleBinding, which the cluster-wide background controller then mutates to add attacker subjects or alter Roles, NetworkPolicies, and ConfigMaps.

Remediation

1. Inventory every kyverno kyverno deployment, including staging.
2. Upgrade kyverno kyverno to 1.19.2.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/kyverno/kyverno/security/advisories/GHSA-f96w-622v-rqpq
• Advisoryhttps://www.vulncheck.com/advisories/kyverno-1.17.0-before-1.19.2-cross-namespace-privilege-escalation-via-namespacedmutatingpolicy