Summary
Kyverno's mutate-existing background processor may allow a namespaced tenant to modify resources outside its namespace because the processor does not properly authorize the target. A tenant able to create a suitable NamespacedMutatingPolicy could affect Namespace objects or resources in another namespace, including stripping Pod Security labels.
Kyverno's mutate-existing background processor may allow a namespaced tenant to modify resources outside its namespace because the processor does not properly authorize the target. A tenant able to create a suitable NamespacedMutatingPolicy could affect Namespace objects or resources in another namespace, including stripping Pod Security labels.
Affected context
The issue occurs in Kyverno's mutate-existing background processor when it handles NamespacedMutatingPolicy targets. Risk arises when a tenant can create such a policy and its target selection, including CEL expressions, can refer to Namespace objects or resources outside the tenant's namespace. The background controller's ServiceAccount may then perform changes without an adequate authorization check for the target.
The issue occurs in Kyverno's mutate-existing background processor when it handles NamespacedMutatingPolicy targets. Risk arises when a tenant can create such a policy and its target selection, including CEL expressions, can refer to Namespace objects or resources outside the tenant's namespace. The background controller's ServiceAccount may then perform changes without an adequate authorization check for the target.
Exploit preconditions
- Attack surface: Kyverno's mutate-existing background processing
- Required access: Ability to create a NamespacedMutatingPolicy
- Trigger point: The background controller processes a policy targeting Namespace objects or victim-namespace resources
- Why exploitation is possible: The processor does not adequately authorize cross-namespace or cluster-scoped mutations before acting as its ServiceAccount
- Attack surface: Kyverno's mutate-existing background processing
- Required access: Ability to create a NamespacedMutatingPolicy
- Trigger point: The background controller processes a policy targeting Namespace objects or victim-namespace resources
- Why exploitation is possible: The processor does not adequately authorize cross-namespace or cluster-scoped mutations before acting as its ServiceAccount
Why this happens
The underlying issue is a missing authorization check, mapped to CWE-862: Missing Authorization. The background processor can act on resources selected by a namespaced policy without sufficiently verifying that the policy's tenant is permitted to modify each target. This creates an insecure boundary between namespaced policy authors and resources outside their namespace.
The underlying issue is a missing authorization check, mapped to CWE-862: Missing Authorization. The background processor can act on resources selected by a namespaced policy without sufficiently verifying that the policy's tenant is permitted to modify each target. This creates an insecure boundary between namespaced policy authors and resources outside their namespace.
Potential impact
- A tenant may modify resources in other namespaces or at cluster scope.
- Pod Security labels could be removed from affected Namespace objects.
- Weakened security labels could allow workloads that would otherwise be restricted.
- Unauthorized changes could disrupt resource integrity or cluster security controls.
- A tenant may modify resources in other namespaces or at cluster scope.
- Pod Security labels could be removed from affected Namespace objects.
- Weakened security labels could allow workloads that would otherwise be restricted.
- Unauthorized changes could disrupt resource integrity or cluster security controls.
General mitigation guidance
Defensive approaches focus on enforcing authorization at the point where each target resource is selected and mutated.
- Check that policy authors are permitted to affect every target, including cluster-scoped resources.
- Apply secure-by-default namespace boundaries and reject targets that exceed a policy's authorized scope.
- Treat policy expressions and target definitions as untrusted input; validate them against explicit scope and resource allowlists.
- Limit the background controller's ServiceAccount permissions to the minimum required.
- Protect sensitive labels and other security controls with independent admission or policy enforcement.
Defensive approaches focus on enforcing authorization at the point where each target resource is selected and mutated.
- Check that policy authors are permitted to affect every target, including cluster-scoped resources.
- Apply secure-by-default namespace boundaries and reject targets that exceed a policy's authorized scope.
- Treat policy expressions and target definitions as untrusted input; validate them against explicit scope and resource allowlists.
- Limit the background controller's ServiceAccount permissions to the minimum required.
- Protect sensitive labels and other security controls with independent admission or policy enforcement.
How teams detect issues like this
Review policy-processing code for authorization checks performed before each mutation, especially where CEL expressions select targets or controller credentials are used. Static analysis and code review can flag mutation paths that rely on broad ServiceAccount permissions without validating the policy author's scope. Monitor audit logs for cross-namespace or cluster-scoped changes initiated by the background controller, and use admission policies to restrict who can create policies targeting sensitive resources.
Review policy-processing code for authorization checks performed before each mutation, especially where CEL expressions select targets or controller credentials are used. Static analysis and code review can flag mutation paths that rely on broad ServiceAccount permissions without validating the policy author's scope. Monitor audit logs for cross-namespace or cluster-scoped changes initiated by the background controller, and use admission policies to restrict who can create policies targeting sensitive resources.
