Read the docs
TI-2025-29083 Aliases CVE-2025-46342GHSA-jrr2-x33p-6hvc

Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Priority MEDIUM 41CWE-1287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00766 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed kyverno (kyverno): 1.13.5, 1.14.0github.com/kyverno/kyverno (Go): 1.13.5, 1.14.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kyvernokyvernobefore 1.13.5; 1.14.0-alpha.1 to before 1.14.01.13.5, 1.14.0Patch availableCNA
—github.com/kyverno/kyverno (Go)before 1.13.51.13.5Patch availableGHSA-jrr2-x33p-6hvc
—github.com/kyverno/kyverno (Go)1.14.0-alpha.1 to before 1.14.01.14.0Patch availableGHSA-jrr2-x33p-6hvc
  • kyverno Vendorkyverno Affected before 1.13.5; 1.14.0-alpha.1 to before 1.14.0 Fixed in 1.13.5, 1.14.0 Patch available CNA
  • github.com/kyverno/kyverno (Go) Vendor— Affected before 1.13.5 Fixed in 1.13.5 Patch available GHSA-jrr2-x33p-6hvc
  • github.com/kyverno/kyverno (Go) Vendor— Affected 1.14.0-alpha.1 to before 1.14.0 Fixed in 1.14.0 Patch available GHSA-jrr2-x33p-6hvc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*up to 1.11.5; 1.12.0 to before 1.13.5Vulnerablekyverno
  • cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:* Versions up to 1.11.5; 1.12.0 to before 1.13.5 Vulnerable ·kyverno

Remediation

  • Fix · CNA kyverno (kyverno) Fixed in 1.13.5, 1.14.0
  • Fix · GHSA-jrr2-x33p-6hvc github.com/kyverno/kyverno (Go) Fixed in 1.13.5 Advisory →
  • Fix · GHSA-jrr2-x33p-6hvc github.com/kyverno/kyverno (Go) Fixed in 1.14.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-46342
  2. 2026-10-03 Alias added: GHSA-jrr2-x33p-6hvc

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-17733 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall CVSS 3.1CRITICAL 10.0
  • TI-2026-29924 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL CVSS 3.1CRITICAL 9.1
  • TI-2026-29524 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token CVSS 3.1HIGH 8.1
  • TI-2025-21189 Kyverno ignores subjectRegExp and IssuerRegExp CVSS 3.1HIGH 8.0
  • TI-2026-30072 Kyverno Controller Denial of Service via forEach Mutation Panic CVSS 3.1HIGH 7.7
  • TI-2026-29707 Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) CVSS 3.1HIGH 7.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences