Summary
When a Kyverno cluster has a policy in enforce mode and two separate PolicyException resources that match the same policy rule, the second exception can override the restrictions imposed by the first. This allows a workload to bypass an enforce-mode policy if it satisfies any one of the configured exceptions — even when the first exception is more restrictive and would have blocked that workload. The flaw exists in how Kyverno evaluates multiple concurrent exceptions for the same rule: a match on the less-restrictive second exception is sufficient to grant the bypass regardless of the first exception's conditions.
Impact
An attacker or misconfigured workload can bypass an otherwise strictly enforced security policy by ensuring the resource satisfies a broadly-scoped PolicyException. The advisory demonstrates this with a disallow-host-path enforce-mode policy: a workload that would be blocked by the namespace-scoped first exception is permitted if its name matches the wildcard pattern (*ingress*) in a second exception, regardless of which namespace it resides in. This creates a path to privilege escalation through techniques such as hostPath volume mounting. All Kyverno deployments running versions v1.9.0 through v1.12.7 with two or more PolicyException resources targeting the same rule are potentially affected.
Detection
Audit the cluster for PolicyException resources (in the kyverno.io/v2beta1 API group) that reference the same policyName and ruleNames as another PolicyException. Pay particular attention to exceptions that use names-based wildcard matching (e.g., names: ['*ingress*']) alongside namespace-scoped exceptions. Review PolicyReport and ClusterPolicyReport resources for unexpected pass results on enforce-mode policies to identify workloads that may have exploited the double-exception bypass.
Mitigation
Upgrade Kyverno to v1.13.0 or later, which corrects the exception evaluation logic. After upgrading, audit all PolicyException resources and ensure that no overlapping exceptions exist for the same policy rule where the less-restrictive exception could be satisfied by a workload the more-restrictive exception was intended to block. Where possible, consolidate multiple exceptions for the same rule into a single PolicyException with explicit conditions, reducing the risk of unintended bypass through evaluation ordering.