Description

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-26T14:16:55.843Z",
  "pubdate": "2026-09-26T14:16:55.843Z",
  "executiveSummary": "A critical path traversal vulnerability exists in Kyverno versions prior to 1.19.1, stemming from improper validation of URL-encoded segments within the Policy apiCall urlPath configuration.\nThis flaw enables tenant users within a constrained namespace to circumvent security boundaries and perform unauthorized operations outside their intended scope.\nBy manipulating the API request paths using percent-encoded sequences, an attacker can coerce the admission-controller ServiceAccount to interact with cluster-scoped resources.\nThe primary risk involves unauthorized creation of cluster-wide entities such as MutatingWebhookConfigurations or sensitive objects within the kyverno namespace.\nSuccessful exploitation results in full privilege escalation, potentially granting the attacker cluster-admin equivalent permissions.\nThe vulnerability is exploitable by any user authorized to create Kyverno policies within a namespace, requiring no specialized external network access beyond the standard Kubernetes API interaction.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization of the urlPath parameter used within Kyverno's Policy apiCall feature. The application fails to resolve or filter directory traversal sequences (e.g., '../') when they are submitted as URL-encoded percent-encoded characters (such as %2e%2e%2f).\nUnder normal operations, Kyverno enforces a 'namespace clamp' to ensure that API calls initiated by policies remain restricted to the namespace where the policy is defined. However, because the validation logic processes the input string before normalizing the path segments, the attacker can inject traversal sequences that the underlying Kubernetes API server interprets as a navigation to a different namespace or cluster-wide scope.\nThe attack flow initiates when an authenticated user with permissions to create Kyverno policies submits a malicious policy object. The apiCall configuration is crafted to include a request path containing the encoded traversal payload. When the Kyverno admission-controller processes this policy, it executes the call using the highly privileged ServiceAccount identity associated with the controller.\nBecause the traversal sequence allows the controller to break out of the intended per-namespace request context, it effectively directs the API request toward protected cluster-level resources or cross-namespace targets. By targeting the Kubernetes API server directly, the attacker can invoke POST, PUT, or PATCH operations on sensitive resources.\nSpecifically, an attacker can orchestrate the creation of a MutatingWebhookConfiguration, which, if configured with a malicious webhook, allows for the interception and modification of arbitrary cluster traffic. Alternatively, modifying resources within the kyverno namespace can allow for the modification of existing policies, effectively granting the attacker full control over the admission control logic of the cluster.\nThis vulnerability is particularly severe because the admission-controller ServiceAccount typically holds permissions sufficient to manage most resources in the cluster. By bypassing the namespace constraints, the attacker leverages these elevated privileges to perform actions that are otherwise prohibited by Kubernetes RBAC for standard tenant users."
}