Kubewarden supports cluster operators to let users install namespaced admission policies with controlled permissions. The vulnerability allows an attacker who has been granted the privileged "AdmissionPolicy" create permission to craft a policy that invokes three deprecated host‑callback APIs – kubernetes/ingresses, kubernetes/namespaces, and kubernetes/services. By executing those callbacks the attacker obtains read access to the Ingress, Namespace, and Service objects in any namespace in the cluster. The flaw does not provide write capabilities nor access to Secrets or ConfigMaps, so the impact is limited to confidentiality compromise for the specified resource types.

The affected vendor and product is Kubewarden – kubewarden-controller. No specific version range is provided in the data, so all releases of the controller that deploy the deprecated host‑callback APIs are considered at risk.

The CVSS score of 4.3 indicates a low severity overall, and the EPSS score of less than 1% suggests a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an attacker who already holds sufficient AdmissionPolicy create permission within the cluster; such a privilege is typically granted to cluster operators or trusted users. If the attacker can deploy or modify admission policies, they can subsequently craft a policy that triggers the host callbacks to exfiltrate the restricted data types. Because the vulnerability is read‑only, a successful exploitation would grant exposure of namespace and ingress configurations to the attacker.