Kyverno: templated generate.clone namespace copies another tenant's ConfigMaps into the attacker's namespace

Impact

A namespaced Policy author can template the namespace value in generate.clone or cloneList, then annotate a triggering ConfigMap so Kyverno's background controller copies a victim namespace's ConfigMap into the attacker's own namespace. The copy is performed by the controller's service account, so the tenant ends up holding data they have no RBAC path to. On a shared GPU cluster that is direct cross-tenant disclosure: ConfigMaps on these clusters routinely carry registry endpoints, dataset paths, model-serving configuration and credentials that were pasted where a Secret should have been. Unlike the APICall bypass in the same release, this is an asynchronous background-controller copy rather than a policy-time read, and it leaves a real object behind in the attacker's namespace.

Who can reach it

Any authenticated tenant with create rights on namespaced Kyverno Policy objects and on the triggering resource in their own namespace. Authentication required; no cross-namespace RBAC needed.

What to do

Upgrade Kyverno to 1.19.2 or later and restart the Kyverno deployments, including the background controller. Interim: remove namespaced Policy create rights from tenants, and audit tenant namespaces for cloned objects that originated elsewhere. Control-plane only - no node drain.

References

Related entries

• docker-socket-proxy: CONTAINERS access lets any client export container filesystems and read filesCVE-2026-78122 · Tecnativa docker-socket-proxy (/containers read endpoints)High
• Kyverno: admission controller ServiceAccount token attached to outbound apiCall requests leaks to any endpointCVE-2026-84195 · Kyverno admission controller (apiCall service mode)High
• Kyverno: SSRF via apiCall.service.url lets authenticated users reach internal and metadata endpointsCVE-2026-84196 · Kyverno admission controller (apiCall.service.url variable substitution)High
• Kubernetes (kubelet): /debug/pprof exposed on the unauthenticated kubelet healthz portCVE-2019-11248 · Kubernetes (kubelet)High
• Envoy: JWT with an issuer absent from the provider list bypasses JWT authenticationCVE-2021-21378 · EnvoyHigh
• KubeVirt: A compromised node's virt-handler service account can be abused cluster-wideCVE-2023-26484 · KubeVirtHigh