Description

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-26T15:16:48.910Z",
  "pubdate": "2026-08-26T15:16:48.910Z",
  "executiveSummary": "A critical privilege escalation vulnerability exists in Kyverno versions 1.18.0 through 1.18.2, categorized as an improper access control issue within the CEL (Common Expression Language) compiler. The flaw allows authenticated users with permissions to create NamespacedMutatingPolicy objects to orchestrate the unauthorized creation or modification of resources in namespaces they do not control.\nThe vulnerability stems from insufficient validation in the NamespacedMutatingPolicy CEL compiler, which fails to restrict the generator library's context to the policy's host namespace. Consequently, the Kyverno admission controller—which operates with elevated cluster-wide privileges—can be coerced into executing resource generation requests across namespace boundaries. This allows an attacker to inject sensitive objects such as Secrets, RoleBindings, or NetworkPolicies into arbitrary namespaces. The impact is significant, as it permits lateral movement and full privilege escalation within the cluster, bypassing the intended security boundaries of namespaced policies. Remediation requires an immediate upgrade to version 1.18.2 or later.",
  "technicalDetails": "The vulnerability resides in the interaction between the NamespacedMutatingPolicy CEL compiler and the internal resource generation library. Specifically, the validation logic located in pkg/cel/policies/mpol/validate.go ensures the CEL expression is syntactically correct but fails to verify that the target namespace context is confined to the namespace where the policy object resides.\nThe exploit leverages the generator.apply(namespace, resources) function, which is exposed to matchConditions within CEL expressions. Because the GenerateResources implementation in pkg/cel/libs/context.go lacks cross-namespace validation logic, it blindly executes the instruction using the admission controller's high-level service account permissions. When a NamespacedMutatingPolicy is triggered, the engine executes the logic with cluster-admin or similar high-level privileges rather than the restricted permissions of the user who submitted the policy.\nThe attack flow follows these steps: 1) An attacker with sufficient RBAC permissions to create a NamespacedMutatingPolicy in a specific namespace drafts a policy containing a CEL matchCondition that invokes generator.apply(). 2) The attacker sets the target namespace parameter in the generator function to a sensitive target namespace, such as 'kube-system' or 'default'. 3) The policy is submitted to the cluster; the compiler performs a successful validation check, bypassing scope enforcement. 4) Upon triggering the policy, the Kyverno admission controller processes the CEL expression. 5) The GenerateResources component executes the resource creation request (e.g., a RoleBinding granting the attacker cluster-admin or a Secret containing credentials) in the target namespace. 6) The cluster's API server fulfills the request because the admission controller is performing the operation with elevated privileges.\nThis vulnerability is effective because the engine treats the CEL generator as a trusted component and does not validate the target parameter against the policy's defined namespace scope. The affected versions are Kyverno 1.18.0 to 1.18.2. Authentication is required to create the malicious policy object, but no further privileges are needed beyond namespace-level write access to Kyverno policies. The post-exploitation impact includes full cluster compromise through the injection of arbitrary Kubernetes objects."
}