Kyverno: namespaced tenants can template generate rules to write resources into any namespace

Impact

A tenant who can create Policy and ConfigMap objects in their own namespace can make Kyverno's privileged background-controller create arbitrary resource kinds in arbitrary namespaces, because the generate rule's kind and namespace accept user-controlled variables. On a shared GPU cluster that means a tenant can drop a RoleBinding into kube-system or rewrite a NetworkPolicy in a victim namespace, which is a path to cluster-admin and to breaking the network isolation between tenants sharing the same fabric. The controller runs with broad write permissions by design, so the tenant inherits those permissions rather than their own. No node-level access is needed - only namespaced RBAC that most multi-tenant clusters hand out freely.

Who can reach it

Any authenticated tenant with permission to create Policy and ConfigMap resources in a namespace they already control. No cluster-scoped rights and no node access required.

What to do

Upgrade Kyverno to 1.19.2 or later; this is a control-plane deployment rolling restart of the Kyverno controllers, not a node operation, so GPU workloads keep running. Until the upgrade lands, audit existing Policy objects for variables in generate rule kind/namespace fields and restrict who may create Policy resources in tenant namespaces.

References

Related entries

• OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster adminCVE-2026-18608 · Red Hat OpenShift AI Data Science Pipelines Operator (ClusterRole)High
• Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh
• local-path-provisioner: helper pod template injection yields a privileged pod with host root mountedCVE-2026-44543 · rancher/local-path-provisioner (helperPod.yaml template in local-path-config ConfigMap)High
• Argo CD: application annotations render as unvalidated hrefs, allowing javascript: execution in an admin sessionCVE-2026-45738 · Argo CD UI (application-summary link.argocd.argoproj.io annotation rendering)High
• NGINX Ingress Controller: unsanitized CRD and annotation fields inject arbitrary NGINX directivesCVE-2026-55723 · NGINX Ingress Controller (configuration generator, CRDs and Ingress annotations)High
• Docker MCP Gateway: OCI image label controls run arguments, allowing host mounts and UID 0CVE-2026-55887 · Docker MCP Gateway (io.docker.server.metadata OCI label -> docker run arguments)High