Description

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and read resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-26T14:16:55.983Z",
  "pubdate": "2026-09-26T14:16:55.983Z",
  "executiveSummary": "A critical namespace isolation bypass vulnerability exists in Kyverno versions prior to 1.19.1, stemming from inconsistent URI path interpretation within the apiCall context entry mechanism. This vulnerability allows an authenticated low-privilege tenant to circumvent established namespace boundaries enforced by policy resources.\nBy manipulating the urlPath with percent-encoded dot-segments, an attacker can coerce the admission controller into performing unauthorized operations outside of their designated namespace. The vulnerability leverages the elevated permissions of the Kyverno admission controller's ServiceAccount, effectively granting the attacker the ability to read resources across the entire cluster that would otherwise be restricted.\nThe risk implication is significant, as it violates the multi-tenancy security model of Kubernetes environments managed by Kyverno. Exploitation requires the attacker to possess sufficient privileges to create or update namespaced Policy resources. Successful exploitation leads to unauthorized information disclosure, potentially exposing sensitive cluster-wide configurations, secrets, or workload metadata to unauthorized tenants.",
  "technicalDetails": "The vulnerability resides within the Kyverno admission controller's handling of the apiCall context entry feature. Kyverno allows administrators to define policies that perform API requests to the Kubernetes API server to retrieve context for policy evaluation. The root cause is a discrepancy in path normalization between the validation phase (which checks if the requested resource aligns with the policy's namespace constraints) and the actual execution phase (where the request is dispatched to the API server).\nDuring the validation phase, Kyverno's policy engine performs namespace verification on the provided urlPath. However, the downstream execution logic fails to adequately sanitize or normalize the URI when processing percent-encoded sequences. An attacker can inject percent-encoded dot-segments (e.g., %2e%2e/) into the urlPath parameter of an apiCall entry. Because the validation layer does not fully resolve these segments before comparing them against the allowed namespace scope, it erroneously permits the request.\nWhen the Kyverno admission controller executes the call, the underlying HTTP client or the Kubernetes API server resolves the percent-encoded segments. This path traversal allows the request to escape the intended namespace context and target resources residing in unauthorized namespaces. Since the admission controller operates with a high-privilege ServiceAccount, the API server treats the request as legitimate, granting the controller access to resources it would normally be forbidden from touching on behalf of the low-privileged tenant.\nThe attack flow is as follows: 1) An attacker with permission to create Kyverno policies defines a namespaced Policy resource containing a malicious apiCall context entry. 2) The attacker sets the urlPath to include percent-encoded dot-segments designed to traverse into a target namespace (e.g., /api/v1/namespaces/target-ns/secrets/%2e%2e/%2e%2e/target-ns/secrets). 3) The validation engine misses the traversal due to inconsistent path interpretation. 4) Upon triggering the policy, the Kyverno controller executes the request using its high-privileged identity. 5) The API server resolves the path traversal, fulfilling the request for the sensitive resource. 6) The attacker extracts the retrieved information via the policy output or status.\nThis issue affects all Kyverno versions prior to 1.19.1. It effectively nullifies the 'namespaced' scope restrictions intended to support secure multi-tenant isolation, resulting in unauthorized cross-namespace data access."
}