Summary
Kyverno's NamespacedMutatingPolicy can allow a namespace tenant to influence which resource a privileged background controller modifies. If a policy uses the affected mutate-existing target-match expression, a tenant may cause the controller to target resources in other namespaces, including sensitive resources.
Kyverno's NamespacedMutatingPolicy can allow a namespace tenant to influence which resource a privileged background controller modifies. If a policy uses the affected mutate-existing target-match expression, a tenant may cause the controller to target resources in other namespaces, including sensitive resources.
Affected context
The issue concerns Kyverno's NamespacedMutatingPolicy mutate-existing behavior when targetMatchConstraints.expression is used. It becomes risky when a namespace tenant can create or influence a policy whose CEL expression returns a target map containing an attacker-chosen metadata.namespace, and the background controller acts on that target with broader permissions than the tenant.
The issue concerns Kyverno's NamespacedMutatingPolicy mutate-existing behavior when targetMatchConstraints.expression is used. It becomes risky when a namespace tenant can create or influence a policy whose CEL expression returns a target map containing an attacker-chosen metadata.namespace, and the background controller acts on that target with broader permissions than the tenant.
Exploit preconditions
- Attack surface: NamespacedMutatingPolicy mutate-existing target matching
- Required access: Ability to create or modify a policy in a namespace where the tenant has access
- Trigger point: The privileged background controller processes the policy's targetMatchConstraints.expression
- Why exploitation is possible: The expression can fabricate a target with a chosen namespace, and the controller may apply the mutation without adequately authorizing that cross-namespace target
- Attack surface: NamespacedMutatingPolicy mutate-existing target matching
- Required access: Ability to create or modify a policy in a namespace where the tenant has access
- Trigger point: The privileged background controller processes the policy's targetMatchConstraints.expression
- Why exploitation is possible: The expression can fabricate a target with a chosen namespace, and the controller may apply the mutation without adequately authorizing that cross-namespace target
Why this happens
The underlying issue is insufficient authorization of a resource target derived from policy-controlled expression output. A CEL map literal can describe a target in a namespace the policy author should not control; if a privileged controller trusts that target without checking the tenant's authority over it, the behavior maps to CWE-862: Missing Authorization.
The underlying issue is insufficient authorization of a resource target derived from policy-controlled expression output. A CEL map literal can describe a target in a namespace the policy author should not control; if a privileged controller trusts that target without checking the tenant's authority over it, the behavior maps to CWE-862: Missing Authorization.
Potential impact
- A tenant may be able to overwrite Secrets, Deployments, or policies outside their namespace
- Unauthorized changes could disrupt workloads or alter security controls
- Sensitive configuration or credentials could be exposed or modified
- The controller's elevated permissions could enable broader cluster impact
- A tenant may be able to overwrite Secrets, Deployments, or policies outside their namespace
- Unauthorized changes could disrupt workloads or alter security controls
- Sensitive configuration or credentials could be exposed or modified
- The controller's elevated permissions could enable broader cluster impact
General mitigation guidance
Defensive patterns focus on ensuring authorization applies to the final resource target, not only to the policy or expression that produced it.
- Constrain mutation targets to namespaces the policy author is authorized to manage
- Validate expression-derived targets against an explicit, trusted allowlist
- Apply authorization checks immediately before the controller performs a mutation
- Reduce the background controller's permissions to the minimum required
- Prefer secure-by-default policy interfaces that do not let tenant-controlled expressions select arbitrary namespaces
- Treat tenant-authored policy content and its computed targets as untrusted
Defensive patterns focus on ensuring authorization applies to the final resource target, not only to the policy or expression that produced it.
- Constrain mutation targets to namespaces the policy author is authorized to manage
- Validate expression-derived targets against an explicit, trusted allowlist
- Apply authorization checks immediately before the controller performs a mutation
- Reduce the background controller's permissions to the minimum required
- Prefer secure-by-default policy interfaces that do not let tenant-controlled expressions select arbitrary namespaces
- Treat tenant-authored policy content and its computed targets as untrusted
How teams detect issues like this
- Review policy evaluation and mutation code for authorization checks on expression-derived targets
- Use static analysis and code review to identify paths where tenant-controlled data reaches privileged resource operations
- Audit NamespacedMutatingPolicy usage, especially mutate-existing expressions that determine target namespaces
- Enforce admission policies that restrict tenant policies from targeting resources outside their authorized namespace
- Monitor controller audit events for cross-namespace mutations initiated by namespaced policies
- Review policy evaluation and mutation code for authorization checks on expression-derived targets
- Use static analysis and code review to identify paths where tenant-controlled data reaches privileged resource operations
- Audit NamespacedMutatingPolicy usage, especially mutate-existing expressions that determine target namespaces
- Enforce admission policies that restrict tenant policies from targeting resources outside their authorized namespace
- Monitor controller audit events for cross-namespace mutations initiated by namespaced policies
