TI-2023-16937 Aliases CVE-2023-34091 GHSA-hq4m-4948-64cc

Kyverno resource with a deletionTimestamp may allow policy circumvention

LOW 29CWE-285Published 2023-06-01 · Updated 2025-01-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00497 42nd percentileScored 2026-11-07

Fix Fixed kyverno (kyverno): 1.10.0github.com/kyverno/kyverno (Go): 1.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kyverno	kyverno	before 1.10.0	1.10.0	Patch available	CNA
—	github.com/kyverno/kyverno (Go)	before 1.10.0	1.10.0	Patch available	GHSA-hq4m-4948-64cc

kyverno Vendorkyverno Affected before 1.10.0 Fixed in 1.10.0 Patch available CNA
github.com/kyverno/kyverno (Go) Vendor— Affected before 1.10.0 Fixed in 1.10.0 Patch available GHSA-hq4m-4948-64cc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nirmata:kyverno::::::go::*	before 1.10.0	Vulnerable	Nirmata

cpe:2.3:a:nirmata:kyverno:*:*:*:*:*:go:*:* Versions before 1.10.0 Vulnerable ·Nirmata

Remediation

Fix · CNA kyverno (kyverno) Fixed in 1.10.0
Fix · GHSA-hq4m-4948-64cc github.com/kyverno/kyverno (Go) Fixed in 1.10.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-34091
2026-10-03 Alias added: GHSA-hq4m-4948-64cc

References

Advisory 2

Other 2

TI-2024-32618 Kyverno's PolicyException objects can be created in any namespace by default CVSS 4.0HIGH 8.7
TI-2026-57895 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions CVSS 4.0CRITICAL 9.4
TI-2026-39369 Missing authorization in kyverno CVSS 3.1CRITICAL 9.6
TI-2026-17733 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall CVSS 3.1CRITICAL 10.0
TI-2026-29924 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL CVSS 3.1CRITICAL 9.1
TI-2026-29524 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token CVSS 3.1HIGH 8.1

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences