Patch Ticker

Kyverno lets namespace admins create and change resources beyond their rights

Some admins of a Kubernetes policy tool can do things beyond their rights!

Summary

Several flaws in the Kyverno policy engine let a namespace admin create or change resources in other namespaces or cluster-wide, beyond their own RBAC rights. Denial of service, policy bypass and image verification bypass are also reported.

Affected when

  • namespace admin rights to create Policy resources

What to do

Update to Kyverno 1.19.2 or later.

Products and platforms

  • kyverno

CVE IDs

11 more CVE IDs

Sources

Times

First published

First seen