CVE-2026-54523

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

Summary

In Kyverno v1.18.1, a tenant who can create a NamespacedMutatingPolicy in their own namespace can instruct the admission controller to generate resources in any namespace by passing an arbitrary namespace string to the CEL generator.apply(namespace, resources) function.

Details

pkg/cel/libs/context.go:177 declares GenerateResources(namespace string, dataList []map[string]any). The namespace argument arrives unvalidated from the CEL expression generator.apply("<target-namespace>", [...]).

Version-Specific Impact

v1.18.0, v1.18.1 (affected via NamespacedMutatingPolicy only):

The nmpol CEL compiler unintentionally exposes the generator library to match condition expressions. A namespaced mutating policy can invoke generator.apply() in a boolean CEL expression such as matchConditions, triggering the admission controller to generate resources in any namespace at request time. This side effect executes with the admission controller's cluster-wide privileges.

NamespacedGeneratingPolicy is not a vector in v1.18.1 due to incomplete webhook and background processing wiring (not registered or functional).

Root Cause

The admission validator for NamespacedMutatingPolicy (pkg/cel/policies/mpol/validate.go) only checks that the policy compiles and does not enforce namespace scope on generator.apply() arguments.

Compare correctly-guarded equivalents: pkg/engine/context/loaders/configmap.go:102 rejects cross-namespace ConfigMap references for namespaced policies, and pkg/engine/apicall/apicall.go:73-82 enforces namespace segment matching. GenerateResources has neither guard.

Proof of Concept

Prerequisites: namespace tenant-ns exists; attacker has create on namespacedmutatingpolicies.policies.kyverno.io in tenant-ns.

apiVersion: policies.kyverno.io/v1beta1
kind: NamespacedMutatingPolicy
metadata:
  name: cross-ns-escalate
  namespace: tenant-ns
spec:
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["configmaps"]
      operations: ["CREATE"]
  mutations:
  - patchType: applyConfiguration
    applyConfiguration:
      expression: object
  matchConditions:
  - name: trigger-escalation
    expression: |
      generator.apply("kube-system", [
        {
          "apiVersion": dyn("v1"),
          "kind": dyn("ConfigMap"),
          "metadata": dyn({
            "name": "kube-system-config",
            "namespace": "kube-system"
          }),
          "data": dyn({
            "injected-by": "tenant-policy",
            "impact": "unauthorized access to kube-system namespace"
          })
        }
      ])

Apply the policy, then create any ConfigMap in tenant-ns to trigger the admission webhook. The admission controller creates configmap/kube-system-config in kube-system. By default, the admission controller has create on ConfigMaps in all namespaces.

Impact

A namespace-scoped user with create on NamespacedMutatingPolicy in >=v1.18.1 can create ConfigMaps, NetworkPolicies, Secrets, and other resources in any namespace using the admission controller's cluster-wide RBAC. This allows:

Injecting sensitive configuration into protected namespaces (e.g., kube-system, default) Disrupting cluster networking via NetworkPolicies Privilege escalation via RoleBinding creation (for roles the admission controller holds or lesser-privileged roles) Privilege escalation via RoleBinding creation in other namespaces Any installation that grants non-admin users access to NamespacedMutatingPolicy creation is affected.

Timeline

• 2026-05-20: Vulnerability reproduced on main
• 2026-07-13: CVE-2026-54523 / GHSA-79gf-7frw-68m9 published
• 2026-07-22: Advisory clarified to document actual v1.18.1 attack vector (NamespacedMutatingPolicy in matchConditions, not NamespacedGeneratingPolicy)

Advisory Update

This advisory was updated to clarify the v1.18.1 attack surface. The nmpol vector in…

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

Summary

In Kyverno v1.18.1, a tenant who can create a NamespacedMutatingPolicy in their own namespace can instruct the admission controller to generate resources in any namespace by passing an arbitrary namespace string to the CEL generator.apply(namespace, resources) function.

Details

pkg/cel/libs/context.go:177 declares GenerateResources(namespace string, dataList []map[string]any). The namespace argument arrives unvalidated from the CEL expression generator.apply("<target-namespace>", [...]).

Version-Specific Impact

v1.18.0, v1.18.1 (affected via NamespacedMutatingPolicy only):

The nmpol CEL compiler unintentionally exposes the generator library to match condition expressions. A namespaced mutating policy can invoke generator.apply() in a boolean CEL expression such as matchConditions, triggering the admission controller to generate resources in any namespace at request time. This side effect executes with the admission controller's cluster-wide privileges.

NamespacedGeneratingPolicy is not a vector in v1.18.1 due to incomplete webhook and background processing wiring (not registered or functional).

Root Cause

The admission validator for NamespacedMutatingPolicy (pkg/cel/policies/mpol/validate.go) only checks that the policy compiles and does not enforce namespace scope on generator.apply() arguments.

Compare correctly-guarded equivalents: pkg/engine/context/loaders/configmap.go:102 rejects cross-namespace ConfigMap references for namespaced policies, and pkg/engine/apicall/apicall.go:73-82 enforces namespace segment matching. GenerateResources has neither guard.

Proof of Concept

Prerequisites: namespace tenant-ns exists; attacker has create on namespacedmutatingpolicies.policies.kyverno.io in tenant-ns.

apiVersion: policies.kyverno.io/v1beta1
kind: NamespacedMutatingPolicy
metadata:
  name: cross-ns-escalate
  namespace: tenant-ns
spec:
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["configmaps"]
      operations: ["CREATE"]
  mutations:
  - patchType: applyConfiguration
    applyConfiguration:
      expression: object
  matchConditions:
  - name: trigger-escalation
    expression: |
      generator.apply("kube-system", [
        {
          "apiVersion": dyn("v1"),
          "kind": dyn("ConfigMap"),
          "metadata": dyn({
            "name": "kube-system-config",
            "namespace": "kube-system"
          }),
          "data": dyn({
            "injected-by": "tenant-policy",
            "impact": "unauthorized access to kube-system namespace"
          })
        }
      ])

Apply the policy, then create any ConfigMap in tenant-ns to trigger the admission webhook. The admission controller creates configmap/kube-system-config in kube-system. By default, the admission controller has create on ConfigMaps in all namespaces.

Impact

A namespace-scoped user with create on NamespacedMutatingPolicy in >=v1.18.1 can create ConfigMaps, NetworkPolicies, Secrets, and other resources in any namespace using the admission controller's cluster-wide RBAC. This allows:

Injecting sensitive configuration into protected namespaces (e.g., kube-system, default) Disrupting cluster networking via NetworkPolicies Privilege escalation via RoleBinding creation (for roles the admission controller holds or lesser-privileged roles) Privilege escalation via RoleBinding creation in other namespaces Any installation that grants non-admin users access to NamespacedMutatingPolicy creation is affected.

Timeline

• 2026-05-20: Vulnerability reproduced on main
• 2026-07-13: CVE-2026-54523 / GHSA-79gf-7frw-68m9 published
• 2026-07-22: Advisory clarified to document actual v1.18.1 attack vector (NamespacedMutatingPolicy in matchConditions, not NamespacedGeneratingPolicy)

Advisory Update

This advisory was updated to clarify the v1.18.1 attack surface. The nmpol vector in…