Kyverno: generate rules are authorized against the controller's RBAC, not the policy author's

Impact

A namespace admin on a shared GPU cluster can author a namespaced Policy with generate rules that target other namespaces or cluster-scoped kinds. Because admission only verifies that the Kyverno background controller has permission, not that the author does, the controller then creates or clones those resources cluster-wide on the attacker's behalf - effectively lending out its own high privilege. On a multi-tenant GPU cluster this is a tenant-to-cluster escalation: the attacker can plant RBAC objects, service accounts or workloads in namespaces belonging to other tenants and schedule onto their GPUs. Kyverno sits in the admission path, so the component that is supposed to enforce tenancy is the one that breaks it.

Who can reach it

An authenticated tenant with rights to create Policy objects in a single namespace. No cluster-level permission and no node access needed; the Kubernetes API server is the only thing that has to be reachable.

What to do

Upgrade Kyverno to 1.19.2 or later per the GitHub advisory. This is a controller deployment rollout - restart of the Kyverno pods, no node drain and no GPU workload interruption, though admission is briefly unavailable during the rolling update so check the webhook failure policy before starting. Until the upgrade lands, restrict who can create Policy objects in tenant namespaces.

References

Related entries

• Kata Containers: Kata with Cloud Hypervisor allows a user to break the VM isolation boundaryCVE-2026-24834 · Kata ContainersCritical
• runwasi wasmtime shim: crafted OCI layer is deserialized as native code, escaping the WASI sandboxCVE-2026-47218 · containerd runwasi containerd-shim-wasmtime-v1 (precompile-cache path)Critical
• mcp-server-kubernetes: leading-dash arguments inject --server and leak the operator's kubeconfig tokenCVE-2026-61459 · mcp-server-kubernetes (kubectl_get / kubectl_describe / kubectl_delete argument handling)Critical
• Kargo: project RBAC delegation lets a user grant itself permissions it does not holdCVE-2026-61850 · Kargo (project-scoped RBAC API: Roles and ServiceAccount bindings)Critical
• Multicluster Engine cluster-proxy-addon: unauthenticated path manipulation proxies to any managed-cluster serviceCVE-2026-66794 · Red Hat Multicluster Engine for Kubernetes (cluster-proxy-addon)Critical
• Traefik: crafted Host port bypasses BasicAuth and IP allowlists on ingress-nginx annotated IngressesCVE-2026-88877 · Traefik ingress-nginx provider (from-to-www-redirect sibling router)Critical