Kyverno versions 1.17.0 through 1.19.1 contain an authorization bypass flaw that lets a user with namespace-level administrative rights escape the confines of their own namespace. The vulnerability arises because the cleanup controller constructs its context loader using a nil policy, allowing an attacker to create a namespaced CleanupPolicy with apiCall or globalReference context entries that are interpreted with the cleanup controller’s ServiceAccount, which has cluster-wide privileges. Consequently, the attacker can read secrets in other namespaces and modify validating webhook configurations, effectively bypassing all namespace isolation controls.

The affected product is Kyverno, version 1.17.0 up to and including 1.19.1 inclusive, provided by the vendor kyverno under the product name kyverno.

The flaw is rated with a CVSS score of 9.4, indicating critical severity. The EPSS score is not available, but the issue is not listed in CISA’s KEV catalog. Attackers need at least namespace-admin privilege to craft the malicious CleanupPolicy, after which the cleanup controller executes the injected calls with cluster-level authority. The vector is presumed to be internal to the cluster; an attacker exploiting the flaw must already have access to the Kubernetes API and sufficient RBAC to create the relevant policy object. All other prerequisites are satisfied by the normal operation of Kyverno in a cluster.