Kyverno before version 1.19.2 contains a privilege escalation flaw that bypasses author permissions during generate‑rule admission checks. The issue is based on CWE‑269, which identifies a failure to limit privilege escalation. An attacker who can create or modify policy objects in a namespace can leverage this bug to generate resource objects in other namespaces or even cluster‑scoped kinds. The vulnerable code checks the controller’s permissions rather than the author’s, allowing the background controller to create or clone resources beyond the intended scope and thereby granting the attacker higher privileges than the RBAC constraints would normally permit.

The vulnerability affects Kyverno deployments running any version prior to 1.19.2. Administrators should review whether their cluster uses Kyverno 1.19.1 or earlier, because those releases do not contain the mitigation for this flaw.

The CVSS score of 9.3 classifies it as Critical, and the EPSS score is not available, indicating no current data on exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers require the ability to create or update Policy objects within a namespace, which most namespace admins possess. Once a valid policy with a generate rule is created, the background controller runs with cluster‑wide privileges and can create resources across the cluster, effectively bypassing normal RBAC controls. The risk is therefore high, especially in environments where namespace administrators have broad write access to policy objects.