Summary
Kyverno's admissionpolicygenerator controller can incorporate PolicyExceptions into generated ValidatingAdmissionPolicies without honoring certain enablement, namespace, and policy-kind gates. A user with namespaced permission to create PolicyExceptions may be able to use this behavior to admit resources that violate cluster-wide policies.
Kyverno's admissionpolicygenerator controller can incorporate PolicyExceptions into generated ValidatingAdmissionPolicies without honoring certain enablement, namespace, and policy-kind gates. A user with namespaced permission to create PolicyExceptions may be able to use this behavior to admit resources that violate cluster-wide policies.
Affected context
The issue affects Kyverno deployments using the admissionpolicygenerator controller to generate ValidatingAdmissionPolicies. The controller may fold PolicyExceptions into generated policies while ignoring the --enablePolicyException, --exceptionNamespace, and policy-kind gates, weakening intended restrictions on exceptions.
The issue affects Kyverno deployments using the admissionpolicygenerator controller to generate ValidatingAdmissionPolicies. The controller may fold PolicyExceptions into generated policies while ignoring the --enablePolicyException, --exceptionNamespace, and policy-kind gates, weakening intended restrictions on exceptions.
Exploit preconditions
- Attack surface: PolicyException handling in the admissionpolicygenerator controller
- Required access: Namespaced permission to create PolicyExceptions
- Trigger point: The controller processes an exception and incorporates it into generated ValidatingAdmissionPolicies
- Why exploitation is possible: The controller does not consistently apply the configured enablement, namespace, and policy-kind gates, allowing negated match conditions to affect admission decisions
- Attack surface: PolicyException handling in the admissionpolicygenerator controller
- Required access: Namespaced permission to create PolicyExceptions
- Trigger point: The controller processes an exception and incorporates it into generated ValidatingAdmissionPolicies
- Why exploitation is possible: The controller does not consistently apply the configured enablement, namespace, and policy-kind gates, allowing negated match conditions to affect admission decisions
Why this happens
This is an authorization enforcement flaw mapped to CWE-863: Incorrect Authorization. The controller applies PolicyExceptions when generating admission policies without consistently enforcing the controls that determine whether those exceptions are enabled and in scope. As a result, exception data can influence policy decisions beyond the intended boundaries.
This is an authorization enforcement flaw mapped to CWE-863: Incorrect Authorization. The controller applies PolicyExceptions when generating admission policies without consistently enforcing the controls that determine whether those exceptions are enabled and in scope. As a result, exception data can influence policy decisions beyond the intended boundaries.
Potential impact
- Resources that violate cluster-wide policies may be admitted
- Policy exception boundaries may be weakened
- Security controls relying on generated ValidatingAdmissionPolicies could be bypassed
- The consistency of admission enforcement across namespaces may be reduced
- Resources that violate cluster-wide policies may be admitted
- Policy exception boundaries may be weakened
- Security controls relying on generated ValidatingAdmissionPolicies could be bypassed
- The consistency of admission enforcement across namespaces may be reduced
General mitigation guidance
Defensive approaches focus on ensuring exceptions are authorized and constrained before they affect generated policies.
- Enforce enablement, namespace, and policy-kind restrictions consistently in the controller
- Treat PolicyExceptions as security-sensitive inputs and limit who can create them
- Validate exception scope and matching conditions against an explicit policy schema
- Prefer secure-by-default behavior that rejects exceptions outside configured boundaries
- Apply least-privilege permissions to users and automation that manage exceptions
Defensive approaches focus on ensuring exceptions are authorized and constrained before they affect generated policies.
- Enforce enablement, namespace, and policy-kind restrictions consistently in the controller
- Treat PolicyExceptions as security-sensitive inputs and limit who can create them
- Validate exception scope and matching conditions against an explicit policy schema
- Prefer secure-by-default behavior that rejects exceptions outside configured boundaries
- Apply least-privilege permissions to users and automation that manage exceptions
How teams detect issues like this
- Review controller code and generated policies for paths that process exceptions without applying all configured gates
- Use static analysis and code review checks to identify inconsistent authorization and scope checks
- Audit PolicyException creation permissions and monitor exception changes, especially in namespaces with cluster-wide enforcement
- Test admission behavior with policy exceptions that vary by namespace, policy kind, and match-condition logic
- Enforce deployment policies that restrict exception creation to approved roles and workflows
- Review controller code and generated policies for paths that process exceptions without applying all configured gates
- Use static analysis and code review checks to identify inconsistent authorization and scope checks
- Audit PolicyException creation permissions and monitor exception changes, especially in namespaces with cluster-wide enforcement
- Test admission behavior with policy exceptions that vary by namespace, policy kind, and match-condition logic
- Enforce deployment policies that restrict exception creation to approved roles and workflows
