Summary
Kyverno's Generation Handler (pkg/webhooks/resource/generation/handler.go) processes non-trigger resource operations via handleNonTrigger → processRequest. When a resource has the app.kubernetes.io/managed-by: kyverno label, processRequest directly trusts all generate.kyverno.io/* labels on the resource to look up policies, find matching rules, and construct UpdateRequest trigger specs via TriggerFromLabels. Because the webhook handler chain does not validate that these internal labels were set by Kyverno itself—and ProtectManagedResources defaults to false and is only enforced in cleanup controllers, never in the admission chain—any user with create or update permissions on resources can spoof these labels to trigger unauthorized execution of existing synchronized generate policies.
Impact
An attacker can spoof generate.kyverno.io/* labels on resources they control to trigger existing generate policies that would otherwise never fire. This bypasses the generateExisting: false gate (skipping pre-existing trigger resources created before the policy) and can also fire rules keyed on trigger kinds the attacker cannot create directly. For clone rules, the cloned resource (Secret or ConfigMap) is created by Kyverno's privileged background client in the attacker's own namespace, enabling unauthorized cross-namespace data access from the source namespace. The exploitation requires create or update access to any resource type matched by an existing synchronized generate policy.
Detection
Monitor for resources in your cluster carrying both app.kubernetes.io/managed-by: kyverno and generate.kyverno.io/* labels that were not created or labeled by Kyverno's background controller. Review Kyverno background-controller logs for UpdateRequest objects created through the admission webhook path (non-background-ServiceAccount callers) for generate rule triggers that do not match expected admission-triggered events. Inspect clone rule targets for unexpected resource creation in tenant namespaces.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which adds validation in the admission webhook handler chain to reject generate.kyverno.io/* labels that were not set by the Kyverno background controller. The upstream advisory names no workaround. Until an upgrade is applied, audit all resources carrying app.kubernetes.io/managed-by: kyverno labels for unexpected generate.kyverno.io/* annotations as an indicator-of-compromise check.
Related Security Guidance
References
- GHSA-hg5v-hwm3-956r — GitHub Security Advisory