Summary
When a Policy or ClusterPolicy with a generate rule is admitted, Kyverno's validator builds its permission checker using the Kyverno service-account identity and runs the SubjectAccessReview as that service account, not as the policy author. The webhook handler never passes the requesting user's identity. If the target kind is a variable, the check is skipped entirely. Three conditions in the default installation make this exploitable by any namespace admin: the chart's policies role aggregates to admin, nothing in admission validation binds a namespaced Policy's generate target to its own namespace or to namespaced kinds, and the generator defaults an empty target namespace to default.
Impact
A namespace admin can create a namespaced Policy with a generate rule that targets any namespace or kind that the Kyverno background controller's ServiceAccount is permitted to write. The background controller then creates or clones the specified resources on the author's behalf, with no check that the author holds the corresponding permissions. This allows a namespace-scoped actor to drive cross-namespace resource creation using the controller's cluster-wide privileges, bypassing multi-tenant isolation. A secondary finding in the same advisory notes that CleanupPolicy admission likewise checks the cleanup controller's delete rights rather than the author's, though the impact is narrower because cleanup only deletes within the policy's own namespace.
Detection
Review all namespaced Policy and ClusterPolicy resources with spec.rules[*].generate blocks. In an unpatched cluster, any generate rule whose target namespace or kind is not constrained to the policy's own namespace represents a potential cross-namespace privilege escalation vector for the policy author. Check whether the chart's admin ClusterRole aggregation grants create on policies.kyverno.io to namespace administrators in your environment.
Mitigation
Upgrade Kyverno to version v1.19.2 or later. Until an upgrade is possible, restrict create and update permissions on policies.kyverno.io and clusterpolicies.kyverno.io to trusted administrators only, removing the default admin ClusterRole aggregation if feasible.
Related Security Guidance
References
- GHSA-q62c-r9v2-cf64 — Kyverno generate-rule RBAC bypass — GitHub Security Advisory