Summary
A namespace-isolation check on the apiCall context entry of namespaced Policy resources in Kyverno can be bypassed using percent-encoded dot-segments (%2e%2e) in urlPath. A low-privilege tenant who can only create a namespaced Policy in their own namespace — with no access to other namespaces — can cause Kyverno to read resources in those namespaces using the admission controller's ServiceAccount rather than the requesting user's identity. The root cause is a path-normalization inconsistency: the isolation check uses path.Clean (lexical only, no percent-decoding) while the request executor uses client-go's rest.Request.RequestURI, which does percent-decode the path before sending it to the API server.
Impact
A tenant who can create a namespaced Policy with an apiCall context entry can craft a urlPath such as /api/v1/namespaces/<own-namespace>/%2e%2e/<victim-namespace>/configmaps/<name>. The isolation check sees the first /namespaces/<own-namespace>/ segment and passes, but the actual HTTP request resolves the percent-decoded .. traversal and reaches /api/v1/namespaces/<victim-namespace>/configmaps/<name>. The response is returned to the Kyverno policy context executed under the admission controller's ServiceAccount, bypassing the tenant's lack of RBAC access to the victim namespace. In a default Kyverno installation, this exposes at minimum all ConfigMaps in every namespace; the reachable data grows with whatever additional permissions the controller ServiceAccount holds.
Detection
Audit all namespaced Policy resources for context entries of type apiCall whose urlPath contains percent-encoded characters, particularly %2e. Use the following command to list all namespaced Policies:
kubectl get policies --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.context}{"\n"}{end}'
Review the Kyverno admission controller's audit log for GET requests to API paths outside its own namespace. Organizations running Kyverno versions prior to 1.19.1 should treat any namespaced Policy with an apiCall context entry as potentially exploited if authored by a non-administrator tenant.
Mitigation
Upgrade Kyverno to version 1.19.1 or later, which corrects the path normalization inconsistency by applying percent-decoding before the namespace-isolation check. Until upgraded, restrict the ability to create namespaced Policy resources with apiCall context entries to trusted administrators using RBAC.