Summary
A namespace tenant with create permission on kyverno.io/v1.Policy in their own namespace can escalate to cluster admin by using method: POST in an apiCall context entry with a percent-encoded path that traverses out of the policy's namespace. The namespace-isolation check is bypassed because it uses path.Clean (which does not percent-decode), while the HTTP executor uses client-go's rest.Request.RequestURI (which does percent-decode), causing the request to resolve to the attacker's intended target. The request is issued under Kyverno's admission-controller ServiceAccount, which holds cluster-wide permissions. This vulnerability is similar to the previously published GHSA-8p9x-46gm-qfx2 and was verified on Kyverno v1.18.1 with default chart values.
Impact
Two distinct attack paths lead to cluster admin escalation. In the first path, the attacker traverses the URL to a cluster-scoped collection (e.g., MutatingWebhookConfiguration) and POSTs a new webhook that rewrites all admitted objects; because the POST runs as the admission-controller ServiceAccount, the webhook is registered cluster-wide and the attacker can subsequently mutate any resource in the cluster. In the second path (requiring the PolicyException feature to be enabled and scoped to the kyverno namespace), the attacker POSTs a PolicyException directly into the kyverno namespace — which the tenant cannot write to directly — disabling an enforcing policy for their namespace and admitting workloads the policy blocked (for example, privileged containers). Both paths were confirmed on a standard kind v1.31.0 cluster with Kyverno chart 3.8.1.
Detection
Audit all namespaced Policy resources for context entries of type apiCall using method: POST with a urlPath containing percent-encoded characters (%2e, %2F, %2f, etc.):
kubectl get policies --all-namespaces -o json | \
grep -E '"urlPath".*%2[eEfF]'
Inspect MutatingWebhookConfiguration resources for any webhooks not created by standard Kyverno installation — these may be artifacts of exploitation via attack path A. Review PolicyException objects in the kyverno namespace for unexpected entries if PolicyExceptions are enabled. Check the Kyverno admission-controller ServiceAccount's audit log for POST requests to cluster-scoped URLs or to namespaces the controller should not be writing to.
Mitigation
Upgrade Kyverno to version 1.19.1 or later immediately. Until upgraded, restrict the ability to create namespaced Policy resources with apiCall context entries using RBAC — limit this permission to cluster administrators. If you suspect exploitation, audit MutatingWebhookConfiguration resources for unexpected entries and rotate permissions.