Kyverno: namespaced PolicyExceptions fold into generated ValidatingAdmissionPolicies, bypassing enforcement

Impact

The admissionpolicygenerator controller folds PolicyExceptions into the ValidatingAdmissionPolicies it generates while ignoring the --enablePolicyException, --exceptionNamespace and policy-kind gates that are supposed to limit them. A tenant with namespaced create rights on PolicyException can inject negated matchConditions and get violating resources admitted, defeating cluster-wide enforcement. On a GPU cluster the policies this bypasses are usually the ones that matter most: blocking privileged containers, hostPath mounts, host networking, or unrestricted access to /dev/nvidia* devices - the controls that keep one tenant's pod off another tenant's GPUs and off the host. This is an enforcement bypass, not a denial of service, so it is silent until someone audits what was admitted.

Who can reach it

Any authenticated tenant with create rights on PolicyException objects in a namespace. Authentication required; exploitable from inside a tenant namespace even where the operator believed exceptions were disabled.

What to do

Upgrade Kyverno to 1.19.2 or later and restart the Kyverno pods. In the meantime, remove namespaced create rights on PolicyException from tenant roles and audit existing PolicyException objects and generated ValidatingAdmissionPolicies for injected matchConditions. Control-plane only - no node maintenance.

References

Related entries

• Kyverno: APICall URLPath query string defeats the namespace regex, reading cluster-scoped resourcesCVE-2026-122312 · Kyverno APICall Fetch() (pkg/engine/apicall/apiCall.go URLPath validation)High
• Kyverno: templated generate.clone namespace copies another tenant's ConfigMaps into the attacker's namespaceCVE-2026-122320 · Kyverno background controller (generate.clone / cloneList namespace templating)High
• docker-socket-proxy: CONTAINERS access lets any client export container filesystems and read filesCVE-2026-78122 · Tecnativa docker-socket-proxy (/containers read endpoints)High
• Kyverno: admission controller ServiceAccount token attached to outbound apiCall requests leaks to any endpointCVE-2026-84195 · Kyverno admission controller (apiCall service mode)High
• Kyverno: SSRF via apiCall.service.url lets authenticated users reach internal and metadata endpointsCVE-2026-84196 · Kyverno admission controller (apiCall.service.url variable substitution)High
• Kubernetes (kubelet): /debug/pprof exposed on the unauthenticated kubelet healthz portCVE-2019-11248 · Kubernetes (kubelet)High