Summary
Kyverno enforces generate rules through two gates: an admission-time RBAC check when a Policy is created, and a runtime write by the background-controller. The admission-time check is entirely skipped when the kind field contains a {{ }} template variable. Additionally, even when the check is not skipped, it is performed as the Kyverno background-controller ServiceAccount rather than as the tenant who authored the policy, creating a confused deputy vulnerability. The result is that a tenant with permission to create a namespaced Policy and a trigger resource in their own namespace can instruct Kyverno to create arbitrary resource kinds in arbitrary namespaces, including RoleBinding in kube-system or NetworkPolicy in a victim tenant's namespace.
Impact
A namespace tenant who can create a namespaced Policy and a trigger resource such as a ConfigMap in their own namespace can exploit this vulnerability to create resources of any kind in any namespace, using the Kyverno background-controller's privileged ServiceAccount as an intermediary. This includes creating RoleBindings in kube-system or hijacking NetworkPolicy resources in other tenant namespaces, breaking multi-tenant isolation boundaries. The critical severity applies specifically when the capability is used to manipulate NetworkPolicy objects, which directly controls tenant network isolation.
Detection
Audit namespaced Kyverno Policy resources for generate rules whose kind or namespace fields contain {{ }} template expressions derived from request object fields such as request.object.metadata.labels or request.object.metadata.annotations. Any such policy that was not intentionally authored by a cluster administrator warrants immediate investigation. Review the Kyverno background-controller audit logs for unexpected resource creation events outside the policy's own namespace.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which contains the fix for this vulnerability. Until the upgrade can be applied, restrict the ability to create namespaced Policy resources (policies.kyverno.io) to trusted namespace administrators only, using Kubernetes RBAC. Avoid granting create on policies.kyverno.io to general tenant users in multi-tenant clusters running Kyverno 1.19.0.