Summary
Kyverno v1.19.1 introduced a namespace clamp for apiCall context entries in namespaced Policies, intended to prevent cross-namespace reads and cluster-scoped writes that were the root cause of GHSA-c5qq-7g2q-cpqp and GHSA-5qq8-67g6-4h2w. The clamp validates path.Clean(url.PathUnescape(urlPath)) but issues the actual HTTP request against the raw urlPath. When url.PathUnescape encounters a malformed percent-escape anywhere in the string (e.g., ?a=%, ?a=%2, ?a=%zz), it returns an error and the clamp falls back to validating the raw, still-encoded string. The API server always fully decodes the path, so the clamp reads one namespace while the request routes to another. A namespace tenant who can only create Policies in their own namespace can use this bypass to read Secrets in any namespace and create cluster-scoped admission webhooks, reaching full cluster admin.
Impact
A namespace tenant whose only permission is create on policies.kyverno.io in their own namespace can exploit this bypass to drive the Kyverno admission-controller ServiceAccount across namespace boundaries. This reopens the cross-namespace Secret read and the cluster-scoped webhook creation paths that were fixed in v1.19.1 for GHSA-c5qq-7g2q-cpqp and GHSA-5qq8-67g6-4h2w. From a cluster-scoped MutatingWebhookConfiguration the attacker can reach full cluster admin. The bypass is an open class of inputs (any malformed percent-escape in a query parameter), not a single payload, so pattern-matching mitigations are insufficient.
Detection
Audit namespaced Kyverno Policy resources for context[].apiCall.urlPath values that contain percent-encoded sequences, particularly malformed sequences such as % followed by fewer than two hex digits or non-hex characters. On Kyverno v1.19.1, any such policy in a multi-tenant cluster warrants immediate review. Kyverno audit logs will show apiCall requests issued by the admission-controller ServiceAccount (system:serviceaccount:kyverno:kyverno-admission-controller); cross-namespace reads by that account that were not initiated by a ClusterPolicy warrant investigation.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which contains the fix. Until the upgrade is applied, restrict create and update permissions on policies.kyverno.io to trusted cluster administrators only, preventing untrusted tenants from authoring namespaced Policies with apiCall context entries. Do not rely on pattern-matching of the urlPath field as a mitigation — the bypass class is too broad to enumerate.