Missing authorization in kyverno
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kyverno | kyverno | 1.18.0 to before 1.18.2 | 1.18.2 | Patch available | CNA |
| — | github.com/kyverno/kyverno (Go) | 1.18.0 to before 1.18.2 | 1.18.2 | Patch available | GHSA-79gf-7frw-68m9 |
- kyverno Vendorkyverno Affected 1.18.0 to before 1.18.2 Fixed in 1.18.2 Patch available CNA
- github.com/kyverno/kyverno (Go) Vendor— Affected 1.18.0 to before 1.18.2 Fixed in 1.18.2 Patch available GHSA-79gf-7frw-68m9
Remediation
- Fix · CNA kyverno (kyverno) Fixed in 1.18.2
- Fix · GHSA-79gf-7frw-68m9 github.com/kyverno/kyverno (Go) Fixed in 1.18.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54523
- 2026-10-03 Alias added: GHSA-79gf-7frw-68m9
References
Other 7
- https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9
- https://github.com/kyverno/kyverno/pull/16238
- https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06
- https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae
- https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df
- https://github.com/kyverno/kyverno/releases/tag/v1.18.2
- https://github.com/kyverno/kyverno
More kyverno vulnerabilities
- TI-2024-32618 Kyverno's PolicyException objects can be created in any namespace by default CVSS 4.0HIGH 8.7
- TI-2026-57895 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions CVSS 4.0CRITICAL 9.4
- TI-2026-17733 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall CVSS 3.1CRITICAL 10.0
- TI-2026-29924 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL CVSS 3.1CRITICAL 9.1
- TI-2026-29524 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token CVSS 3.1HIGH 8.1
- TI-2025-14241 Kyverno before v1.13.4 SSRF via Service Call CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-54523 · CVE Program
- CVE-2026-54523 · NVD
- FIRST EPSS
- GHSA-79gf-7frw-68m9 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-54523 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences