Critical · published January 27, 2026
🔥 A critical authorization bypass lurks in Kyverno versions prior to 1.16.3 and 1.15.3! Any authenticated user can exploit this flaw, undermining namespace isolation in your Kubernetes environment. ⚡ Think of it like a hotel where every guest can access not just their own room, but also roam into any other room in the building — a recipe for chaos! In this case, the lack of checks allows users to make API requests across namespaces, just like a guest opening any door without a key. An attacker could leverage this vulnerability to read sensitive data from other namespaces, like ConfigMaps or Secrets, and even create malicious policies that affect the entire cluster. This could lead to unauthorized access and significant security breaches, putting your entire Kubernetes environment at risk!
Think of it like a hotel where every guest can access not just their own room, but also roam into any other room in the building — a recipe for chaos! In this case, the lack of checks allows users to make API requests across namespaces, just like a guest opening any door without a key. This vulnerability allows authenticated users with permission to create namespaced policies to execute Kubernetes API requests using the Kyverno admission controller, bypassing namespace restrictions. This occurs because the `urlPath` isn't properly constrained to the policy's namespace.
An attacker could leverage this vulnerability to read sensitive data from other namespaces, like ConfigMaps or Secrets, and even create malicious policies that affect the entire cluster. This could lead to unauthorized access and significant security breaches, putting your entire Kubernetes environment at risk! Immediate update to Kyverno version 1.16.3 or 1.15.3 is crucial to close this vulnerability. Additionally, review RBAC settings and ensure that policy permissions are tightly controlled. Don't skip auditing your namespaces! You've got this! With these steps, you can secure your Kubernetes deployment and boost your defender status! 🛡️