Summary
Due to a missing error propagation in GetNamespaceSelectorsFromNamespaceLister in pkg/utils/engine/labels.go, policy rules using namespace selector(s) in their match statements may mistakenly not apply during admission review request processing. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with Kubernetes API access to perform malicious operations.
Impact
When Kyverno handles an admission webhook, the function calls a NamespaceLister to retrieve the namespace's labels. If the lister returns an error, the helper swallows the error and returns an empty label map — equivalent to a namespace without any labels. Policy rules that match on namespace labels (e.g., matchExpressions: [{key: label1, operator: Exists}]) are then evaluated against an empty label set and silently skipped. The Kube API request is accepted without the security-relevant patches and validations.
In environments where Kyverno is the primary admission control for sensitive operations (PSA enforcement, image policy, ConfigMap protection), this is a complete bypass for the affected rules. The CVSS score (8.6) reflects that the bypass is silent and applies in production traffic.
Detection
Kyverno emits no specific signal when this swallowing occurs. Indirect signs:
- Policy reports show no entries for resources that should have been matched by namespace-selector-scoped rules.
- Admission audit logs show requests passing without the expected mutation patches applied.
- Kyverno controller logs may contain transient lister errors around the affected periods.
For a definitive review, audit any policy whose match block uses namespaceSelector and re-run those policies against the live cluster (kyverno apply --report) on a patched version.
Mitigation
Upgrade Kyverno to v1.14.0 or v1.13.5 (or later on the matching line). Versions 1.11 and 1.12 do not have a fix and must be upgraded to a supported line.
Workaround until patched: avoid relying on namespace-selector-scoped rules for security-critical enforcement. Where possible, replace with explicit per-namespace Policy resources or use match.any.resources.namespaces lists, which do not rely on the affected helper.