Summary
A privilege escalation flaw in Kyverno's NamespacedMutatingPolicy handling can let a namespace-scoped tenant cause resources in other namespaces to be modified. The risk arises when a policy's CEL output selects a target without adequate namespace checks and the cluster-wide background controller processes that target.
A privilege escalation flaw in Kyverno's NamespacedMutatingPolicy handling can let a namespace-scoped tenant cause resources in other namespaces to be modified. The risk arises when a policy's CEL output selects a target without adequate namespace checks and the cluster-wide background controller processes that target.
Affected context
The vulnerability affects Kyverno deployments using NamespacedMutatingPolicy with targetMatchConstraints.expression. It becomes risky when the expression can produce a target outside the policy's namespace and the background controller applies mutations without adequately restricting that target.
The vulnerability affects Kyverno deployments using NamespacedMutatingPolicy with targetMatchConstraints.expression. It becomes risky when the expression can produce a target outside the policy's namespace and the background controller applies mutations without adequately restricting that target.
Exploit preconditions
- Attack surface: NamespacedMutatingPolicy evaluation and mutation by the cluster-wide background controller
- Required access: Ability to create or modify a NamespacedMutatingPolicy in a tenant-accessible namespace
- Trigger point: The controller evaluates the policy and processes its CEL-produced target
- Why exploitation is possible: The target expression can lack namespace checks, allowing a target in another namespace to be selected for mutation
- Attack surface: NamespacedMutatingPolicy evaluation and mutation by the cluster-wide background controller
- Required access: Ability to create or modify a NamespacedMutatingPolicy in a tenant-accessible namespace
- Trigger point: The controller evaluates the policy and processes its CEL-produced target
- Why exploitation is possible: The target expression can lack namespace checks, allowing a target in another namespace to be selected for mutation
Why this happens
The underlying issue is insufficient authorization and scope enforcement when policy output determines which resources a privileged controller mutates. If a NamespacedMutatingPolicy's CEL expression can select targets without verifying that they are within the policy's permitted namespace, a namespace-scoped tenant may influence a cluster-wide controller to act beyond that tenant's authority. This maps to CWE-269: Improper Privilege Management.
The underlying issue is insufficient authorization and scope enforcement when policy output determines which resources a privileged controller mutates. If a NamespacedMutatingPolicy's CEL expression can select targets without verifying that they are within the policy's permitted namespace, a namespace-scoped tenant may influence a cluster-wide controller to act beyond that tenant's authority. This maps to CWE-269: Improper Privilege Management.
Potential impact
- An attacker could add subjects to another namespace's RoleBinding or alter its role assignments.
- An attacker may modify NetworkPolicies or ConfigMaps in namespaces they do not control.
- Cross-namespace changes could weaken access controls or disrupt workloads.
- The incident could enable further unauthorized access, depending on the affected resources and cluster configuration.
- An attacker could add subjects to another namespace's RoleBinding or alter its role assignments.
- An attacker may modify NetworkPolicies or ConfigMaps in namespaces they do not control.
- Cross-namespace changes could weaken access controls or disrupt workloads.
- The incident could enable further unauthorized access, depending on the affected resources and cluster configuration.
General mitigation guidance
Defensive patterns focus on ensuring that policy scope cannot exceed the author's authority:
- Enforce namespace boundaries on every resolved target, independently of CEL output.
- Prefer target selection that is constrained by trusted policy context and explicit namespace allowlists.
- Validate policy expressions and their possible outputs before a privileged controller applies mutations.
- Ensure the controller checks authorization for each target and mutation rather than relying only on policy creation permissions.
- Apply least privilege to controller identities and limit tenant permissions to create or modify policies.
Defensive patterns focus on ensuring that policy scope cannot exceed the author's authority:
- Enforce namespace boundaries on every resolved target, independently of CEL output.
- Prefer target selection that is constrained by trusted policy context and explicit namespace allowlists.
- Validate policy expressions and their possible outputs before a privileged controller applies mutations.
- Ensure the controller checks authorization for each target and mutation rather than relying only on policy creation permissions.
- Apply least privilege to controller identities and limit tenant permissions to create or modify policies.
How teams detect issues like this
- Review policy evaluation paths for CEL-derived targets that are not checked against the policy namespace or an explicit allowlist.
- Use static analysis and code review to identify privileged controllers that trust tenant-controlled policy output when selecting resources.
- Audit NamespacedMutatingPolicy definitions and controller logs for cross-namespace target selection or unexpected mutations.
- Enforce admission policies that restrict target namespaces and require explicit authorization for cross-namespace effects.
- Automated code review tools can help flag missing scope checks in policy and controller logic.
- Review policy evaluation paths for CEL-derived targets that are not checked against the policy namespace or an explicit allowlist.
- Use static analysis and code review to identify privileged controllers that trust tenant-controlled policy output when selecting resources.
- Audit NamespacedMutatingPolicy definitions and controller logs for cross-namespace target selection or unexpected mutations.
- Enforce admission policies that restrict target namespaces and require explicit authorization for cross-namespace effects.
- Automated code review tools can help flag missing scope checks in policy and controller logic.
