Kyverno: namespace-scoped policy escapes its namespace clamp and escalates to cluster admin

Impact

A tenant who can create a namespaced Kyverno Policy in their own namespace can append malformed percent-escapes to an apiCall urlPath and break out of the namespace clamp. The call then runs with the admission controller's ServiceAccount, which is cluster-wide, so the tenant can read resources in every other namespace and create mutating webhooks. A mutating webhook is cluster admin in practice: it sees and can rewrite every object admitted to the cluster, including pods on GPU nodes and the secrets mounted into them. On a shared GPU cluster where namespaces are the tenant boundary, this collapses that boundary from the one place tenants are explicitly allowed to write policy.

Who can reach it

Any authenticated tenant with permission to create Policy objects in a namespace they control - no cluster-scoped rights needed. Reachable from the Kubernetes API alone, no pod or GPU access required.

What to do

Upgrade Kyverno to 1.19.2. Rolling the admission controller Deployment is a daemon restart, not a node action, but plan for a brief admission gap: with failurePolicy=Fail, admission stalls while the webhook pods are replaced. Until the upgrade lands, revoke tenant RBAC for creating namespaced Policy resources, or audit existing policies for apiCall rules whose urlPath contains percent-escapes.

References

Related entries

• Harbor: Hard-coded default credentials give web UI access to the whole registryCVE-2026-4404 · HarborCritical
• Azure Kubernetes Service: incorrect authorization lets an authorized attacker elevate privileges remotelyCVE-2026-50516 · Microsoft Azure Kubernetes Service (authorization checks)Critical
• containerd: CRI plugin propagates unvalidated image LABEL values into container configCVE-2026-53488 · containerdCritical
• Dokploy: registry password and URL interpolated unescaped into a swarm deploy commandCVE-2026-72879 · Dokploy registry credential handling (getRegistryCommands in cluster/upload.ts)Critical
• Kyverno: overlapping PolicyExceptions let a tenant bypass an enforce-mode policyCVE-2026-84200 · Kyverno admission controller (PolicyException handling)Critical
• Kyverno: 3DES cipher suites offered on TLS endpoints expose long-lived sessions to Sweet32CVE-2023-54356 · Kyverno TLS endpoints (3DES cipher suites)Critical