What is Kubernetes security?

Kubernetes security encompasses the practices, tools, and configurations used to protect Kubernetes clusters, workloads, and data. It includes authentication, authorization (RBAC), network policies, pod security standards, secrets management, and runtime security.

What is the CKS certification?

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification that validates expertise in securing Kubernetes clusters. It covers cluster setup and hardening, system hardening, minimizing microservice vulnerabilities, and supply chain security.

What are Kubernetes network policies?

Network policies are Kubernetes resources that control pod-to-pod and pod-to-external traffic. They act as a firewall for your cluster, allowing you to specify which pods can communicate with each other based on labels, namespaces, and ports.

What are Pod Security Standards?

Pod Security Standards (PSS) are predefined security profiles that define different levels of pod security restrictions: Privileged (unrestricted), Baseline (minimally restrictive to prevent known privilege escalations), and Restricted (heavily restricted following security best practices).

What is RBAC in Kubernetes?

Role-Based Access Control (RBAC) is a Kubernetes authorization mechanism that regulates access to resources based on user roles. It uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources to define and assign permissions to users and service accounts.

How do I secure etcd in Kubernetes?

Secure etcd by enabling encryption at rest for secrets, using TLS for client-server communication, restricting access to etcd endpoints via firewall rules, enabling authentication, and running regular backups. etcd stores all cluster data including secrets.

What is a container escape attack?

A container escape attack occurs when a process breaks out of container isolation to access the host system or other containers. Common vectors include privileged containers, hostPath mounts, and kernel exploits. Mitigate with Pod Security Standards and seccomp profiles.

What tools are used for Kubernetes security scanning?

Popular Kubernetes security tools include Trivy (vulnerability scanning), Falco (runtime security), kube-bench (CIS benchmarks), OPA Gatekeeper and Kyverno (policy enforcement), Kubescape (security posture), and Cosign (image signing).

GHSA-qc9c-3fgf-cgq8 — PolicyException gates bypassed in admissionpolicygenerator

HIGH7.7GHSA-qc9c-3fgf-cgq8

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected projects: kyverno
Disclosed: October 21, 2026
Last updated: October 23, 2026

Affected versions

Project	Vulnerable range
github.com/kyverno/kyverno	`<=1.19.1`

Patched versions

Project	Fixed in
github.com/kyverno/kyverno	`1.19.2`

References

GHSA-qc9c-3fgf-cgq8

Summary

Kyverno's admissionpolicygenerator controller generates Kubernetes ValidatingAdmissionPolicies (VAPs) and MutatingAdmissionPolicies (MAPs) from Kyverno ValidatingPolicies and MutatingPolicies. When folding PolicyExceptions into the generated VAPs, the controller's getCELExceptions and getExceptions helpers match exceptions by policy name only, ignoring all enforcement gates: the --enablePolicyException feature flag (default false), the --exceptionNamespace confinement, and the policyRefs[].kind check. Because the Kyverno webhook no longer intercepts resources once a VAP is generated for a policy, the generated VAP becomes the sole enforcement layer. Any user who can create a namespaced PolicyException can therefore exempt arbitrary resources from cluster-scoped ValidatingPolicy enforcement, regardless of how the cluster administrator configured the exception gates.

Impact

A user who can create policyexceptions.policies.kyverno.io in any namespace — even when --enablePolicyException is false and the Kyverno validation webhook issues only a warning — can cause the admissionpolicygenerator to bake that exception into the generated VAP. This bypasses the cluster-wide ValidatingPolicy enforcement for resources matching the exception's conditions, regardless of --exceptionNamespace confinement or per-policy kind restrictions. The impact is a cluster-wide policy bypass affecting the integrity of admission control for all resources governed by the affected ValidatingPolicy.

Detection

Audit all namespaced PolicyException resources (policyexceptions.policies.kyverno.io) across the cluster and compare them against the --exceptionNamespace and --enablePolicyException settings in the Kyverno admission-controller configuration. Any PolicyException that exists outside the configured exception namespace or was created while --enablePolicyException=false should be treated as potentially malicious. Inspect the matchConditions of generated ValidatingAdmissionPolicies for exception conditions injected from these resources.

Mitigation

Upgrade Kyverno to version 1.19.2 or later, which enforces the --enablePolicyException, --exceptionNamespace, and policyRefs[].kind gates in the admissionpolicygenerator exception selection logic. As an interim measure, restrict create and update permissions on policyexceptions.policies.kyverno.io to the configured exception namespace only, and regularly audit the matchConditions of generated ValidatingAdmissionPolicy resources for unexpected exception entries.

References

GHSA-qc9c-3fgf-cgq8 — Kyverno Security Advisory

Affected versions

Patched versions

References

Summary​

Impact​

Detection​

Mitigation​

Related Security Guidance​

References​

Summary

Impact

Detection

Mitigation

Related Security Guidance

References