Description

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. A tenant who can create a namespaced policy (e.g. NamespacedValidatingPolicy, and likewise the namespaced mutating, deleting, generating, and image-validating policy kinds) in their own namespace can call globalContext.get("<entry>", "") and receive the full cached contents of a cluster-scoped GlobalContextEntry, including data cached from namespaces the tenant has no RBAC permission to read. No admission validation rejects such calls. Fixed in 1.19.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-26T14:16:55.420Z",
  "pubdate": "2026-09-26T14:16:55.420Z",
  "executiveSummary": "A critical authorization flaw exists in Kyverno versions 1.16.0 through 1.19.0, allowing unauthorized information disclosure via the CEL (Common Expression Language) evaluation engine.\nThe vulnerability originates from the improper registration of the 'globalcontext.Lib' library within the policy environment, which fails to enforce namespace isolation for cluster-scoped data.\nA tenant with sufficient RBAC permissions to create namespaced policy resources—such as NamespacedValidatingPolicy or NamespacedMutatingPolicy—can invoke 'globalContext.get()' to extract sensitive cached data from GlobalContextEntry objects.\nThis allows an attacker to bypass standard Kubernetes RBAC controls, enabling the retrieval of information from namespaces they are otherwise unauthorized to access.\nThe risk is categorized as high, as it facilitates unauthorized cross-tenant data exfiltration within multi-tenant Kubernetes clusters. The issue is resolved in version 1.19.1 by correctly applying namespace-scoped restrictions to the global context library.",
  "technicalDetails": "The root cause of this vulnerability lies in the inconsistent implementation of access control boundaries within the Kyverno policy engine. While other sensitive libraries, such as 'resource.Lib', 'http.Lib', and the ConfigMap loader, are correctly initialized with policy-specific namespace context to restrict data access, the 'globalcontext.Lib' library is registered globally.\nWhen a user defines a namespaced policy, the Kyverno controller environment should logically scope its evaluation context to prevent accessing cluster-wide resources that reside outside the authorized namespace. By failing to confine 'globalcontext.Lib', the CEL environment effectively grants any policy author the ability to query any 'GlobalContextEntry' stored within the Kyverno cache.\nThe attack flow proceeds as follows: 1. An attacker identifies a cluster where they possess permissions to create namespaced policy kinds (e.g., NamespacedValidatingPolicy). 2. The attacker crafts a malicious policy rule that utilizes the CEL 'globalContext.get()' function. 3. The attacker passes the desired 'entry' name as an argument to the function. 4. Upon policy evaluation, Kyverno executes the call within the CEL engine without validating the caller's authority against the target entry's scope. 5. The engine returns the full contents of the requested GlobalContextEntry, regardless of whether that data originated from or pertains to namespaces the attacker should be restricted from accessing.\nThis exploitation requires no special privileges beyond the ability to create standard Kyverno policy resources. Because this process occurs at the admission controller level during policy evaluation, there are no existing admission validation mechanisms within the affected versions to intercept or reject these malicious calls, leading to a bypass of standard Kubernetes RBAC security models.\nThe post-exploitation impact includes the potential exfiltration of sensitive configuration details, secrets, or internal metadata cached in GlobalContextEntries, which may contain information from other tenants or privileged cluster components."
}