Kyverno versions 1.17.0 through 1.19.1 expose a privilege escalation flaw that enables tenants confined to a single namespace to modify resources in other namespaces. The flaw stems from an expression in NamespacedMutatingPolicy targetMatchConstraints that evaluates a Content Expression Language (CEL) expression without verifying the target namespace. Consequently, an attacker can construct a deleterious rule targeting another tenant’s RoleBinding or other role‑based objects, and the controller will then mutate those objects to add attacker subjects or alter roles, network policies, or config maps. The effect is a significant breach of isolation boundaries, effectively turning a tenant‑level identity into a cluster‑wide actor.

The affected product is Kyverno for Kubernetes, specifically the Kyverno operator version 1.17.0 up to and including 1.19.1. All installations of the operator that default to the vulnerable policy handling mechanism are impacted, regardless of the cluster size or the number of namespaces configured.

The vulnerability carries a CVSS score of 9.4, signifying critical severity. EPSS data is unavailable, but the design of the vulnerability—cluster‑wide background controller and the ability to inject arbitrary policies—suggests a high chance of exploitation in environments where tenants are granted the ability to create policies. The vulnerability is not presently listed in the CISA KEV catalog, but its impact and the lack of namespace checks recommend that organizations treat it as an active threat. Attackers can leverage an authenticated tenant role to deploy a malicious NamespacedMutatingPolicy that targets another tenant’s resources; the controller then automatically applies the mutation, bypassing namespace isolation.