Summary
A Kubernetes tenant permitted to create a NamespacedMutatingPolicy in their own namespace can mutate resources that live outside that namespace — including every cluster-scoped Namespace object cluster-wide and, via a CEL target expression, arbitrary resources in victim namespaces. The CEL mutate-existing background processor in pkg/background/mpol/processor.go resolves and writes its target with no check that the target's namespace equals the policy's namespace and no cluster-scope guard. All writes are performed with Kyverno's cluster-powerful background-controller service account without any SubjectAccessReview against the policy author, making this a confused-deputy attack that redirects Kyverno's own RBAC at the whole cluster.
Impact
The root cause is in processor.Process() in pkg/background/mpol/processor.go, which scopes only which policies fire to the tenant's namespace but never which resources they write. Two target-resolution code paths both escape the namespace boundary: in the ResourceRules path, collectGVK is passed the policy namespace but ns is reset to "" whenever the target kind is Namespace, so ListResource enumerates that resource cluster-wide; in the CEL Expression path, getTargetsFromExpression() returns objects whose metadata.namespace comes from the attacker-authored expression without re-validation against the policy namespace. The write step in processor.go then uses new.GetNamespace() — the target's own namespace — with no guard. This vulnerability is the write-side sibling of cross-namespace read isolation breaches GHSA-cvq5-hhx3-f99p and GHSA-8p9x-46gm-qfx2 on a new policy type and a distinct code path that those fixes never addressed.
Detection
Monitor Kubernetes API server audit logs for unexpected mutations to resources across multiple namespaces originating from the Kyverno background-controller service account. Review NamespacedMutatingPolicy objects for spec.evaluation.mutateExisting entries whose target expressions reference resources outside the policy's own namespace. Unexpected patches to Namespace objects or resources in unrelated namespaces by the background-controller warrant investigation. Consult the advisory at the reference URL for the full vulnerability analysis and proof-of-concept details.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which adds namespace scope enforcement to the CEL mutate-existing background processor. Until upgraded, remove or restrict NamespacedMutatingPolicy creation permissions from untrusted tenants. Avoid granting the create verb on kyverno.io namespacedmutatingpolicies to roles held by untrusted namespace administrators.
Related Security Guidance
References
- GHSA-vm98-8c25-h274 — Kyverno Security Advisory