Summary
Kyverno's generate.clone and generate.cloneList features allow a policy to copy a resource from a source namespace into the policy's own namespace. Unlike the analogous apiCall.urlPath and context[].configMap.namespace features — which were patched in CVE-2026-22039 and GHSA-cvq5-hhx3-f99p respectively — the CloneFrom.Namespace and CloneList.Namespace fields are never validated against the policy's own namespace. Because the background-controller performs the read with its cluster-wide-read ServiceAccount and no caller-side SubjectAccessReview is issued for the triggering user, a namespace tenant who can create a namespaced Policy can instruct Kyverno to fetch and copy the contents of any ConfigMap or other resource from any namespace into their own namespace.
Impact
A tenant with permission to create a namespaced Policy in their own namespace can read the contents of any resource that the Kyverno background-controller ServiceAccount can get or list cluster-wide — by default, this includes ConfigMaps and Secrets (depending on cluster RBAC configuration) in all namespaces. The exfiltrated content appears as a new resource in the attacker's own namespace. Multi-tenant clusters running Kyverno v1.18.1 or earlier are at risk of cross-tenant data disclosure via this mechanism.
Detection
Audit namespaced Kyverno Policy resources for generate rules that use clone.namespace or cloneList.namespace fields containing template expressions (e.g., {{ request.object.metadata.annotations.* }}). Any clone policy whose source namespace is not statically set to the same namespace as the policy itself and was not created by a trusted cluster administrator warrants review. The Kyverno background-controller audit log will show get and list calls issued for resources outside the policy's own namespace.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which enforces that the resolved clone.namespace and cloneList.namespace values must equal the policy's own namespace for namespaced Policy resources, consistent with the protections applied to apiCall.urlPath and configMap.namespace. Until the upgrade is applied, restrict create permissions on policies.kyverno.io to trusted administrators and audit all existing generate rules with variable-driven clone source namespaces.