Summary
A NamespacedMutatingPolicy with evaluation.mutateExisting.enabled=true allows a namespace tenant to overwrite pre-existing resources in namespaces they do not control, and cluster-scoped resources, by supplying a raw CEL targetMatchConstraints.expression that returns a map literal fabricating a target object whose metadata.namespace is attacker-chosen. The background controller then applies the mutation and writes it back using Kyverno's privileged background ServiceAccount, with no per-target namespace or scope check and no authorization check against the tenant.
Impact
An attacker who holds create on namespacedmutatingpolicies.policies.kyverno.io in a single namespace can overwrite the full content of pre-existing resources in other namespaces and, for cluster-scoped kinds, cluster-wide. The write executes with the background controller's privileges, so the tenant's own RBAC in the victim namespace is never consulted. On a default install, the background ServiceAccount can overwrite Kyverno's own policy custom resources and GlobalContextEntry objects cluster-wide, allowing a tenant to neutralize cluster-wide security policies from within their own namespace. A secondary escape on the resource-rules branch drops namespace confinement when the target kind is Namespace or the namespace glob is *, enabling cluster-wide listing and mutation of all Namespace objects.
Detection
Audit all NamespacedMutatingPolicy resources in your cluster for spec.evaluation.mutateExisting.enabled=true combined with a non-empty spec.matchConstraints.resourceRules[*].targetMatchConstraints.expression. Any such policy in an unpatched cluster running Kyverno 1.18.0 through 1.19.1 can be exploited by the policy author to write resources outside their namespace. Kyverno admission validation does not block globalContext.* or http.*—only those two expression prefixes are forbidden for namespaced policies—so no admission-time signal blocks the malicious policy.
Mitigation
Upgrade Kyverno to version 1.19.2 or later. Until an upgrade is possible, restrict create and update permissions on namespacedmutatingpolicies.policies.kyverno.io to trusted administrators only, or disable evaluation.mutateExisting cluster-wide if the feature is not required.
Related Security Guidance
References
- GHSA-jcw5-3wcg-fqx5 — NamespacedMutatingPolicy cross-namespace overwrite — GitHub Security Advisory