# CVE-2026-29773: Kubewarden incorrect authorization in deprecated host-callback APIs

Source: https://junglewise.ai/threats/cve-2026-29773-kubewarden-incorrect-authorization-in-deprecated-host-callback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-29773 · Severity: medium · CVSS 4.3 · Published 2026-03-10

Kubewarden is a policy engine used to manage security and compliance within Kubernetes clusters. A vulnerability in certain deprecated components allows users with the ability to create policies to bypass intended security boundaries and read information about other parts of the cluster. While attackers cannot modify data or access sensitive secrets, they can view network routing rules, service names, and internal IP addresses, potentially aiding in further attacks.

Technologies: [github.com/kubewarden/kubewarden-controller (Go)](https://junglewise.ai/threats/technologies/github-com-kubewarden-kubewarden-controller). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Linuxfoundation](https://junglewise.ai/threats/vendors/linuxfoundation).

## Quick answers

**Is CVE-2026-29773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29773 being exploited in the wild.

**How severe is CVE-2026-29773?** Medium severity, with a CVSS score of 4.3, published 10 March 2026.

**Which products and versions are affected?** github.com/kubewarden/kubewarden-controller (Go) SEMVER:introduced=0,fixed=1.33.0; Kubewarden Admission Controller 1.6.0 to 1.33.0.

**Is there a fix for CVE-2026-29773?** Yes. github.com/kubewarden/kubewarden-controller (Go): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29773 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-29773?** Check whether you run github.com/kubewarden/kubewarden-controller (Go), Kubewarden Admission Controller or Linuxfoundation Kubewarden at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/kubewarden/kubewarden-controller (Go): upgrade to 1.33.0 or later

  ```sh
  go get github.com/kubewarden/kubewarden-controller@v1.33.0
  ```


## Technical details

A vulnerability exists in the Kubewarden policy-evaluator where three deprecated host-callback APIs (kubernetes/ingresses, kubernetes/namespaces, and kubernetes/services) do not properly enforce namespaced isolation. An attacker with permissions to create or update 'AdmissionPolicy' or 'AdmissionPolicyGroup' resources can craft a malicious policy that invokes these callbacks. This allows the attacker to exfiltrate metadata about cluster resources across all namespaces, including internal topology and routing rules. The issue is rooted in incorrect authorization (CWE-863) within the waPC binding layer. The vulnerability is read-only and does not grant access to Secrets or ConfigMaps. The issue was resolved in version 1.33.0 by removing the deprecated bindings.

## Affected products

- Kubewarden Kubewarden Admission Controller 1.6.0 to 1.33.0

## Identifiers

- CVE-2026-29773
- GHSA-6r7f-3fwq-hq74
- GO-2026-4652

## Timeline

- 2026-02-26: patched: Deprecated WAPC bindings removed in pull request 1519
- 2026-03-09: advisory: Vendor advisory GHSA-6r7f-3fwq-hq74 published
- 2026-03-10: disclosed: CVE-2026-29773 published

## References

- [https://github.com/kubewarden/kubewarden-controller/commit/4e41b60ae44902d82d94101bac93fb77cae65651](https://github.com/kubewarden/kubewarden-controller/commit/4e41b60ae44902d82d94101bac93fb77cae65651)
- [https://github.com/kubewarden/kubewarden-controller/pull/1519](https://github.com/kubewarden/kubewarden-controller/pull/1519)
- [https://github.com/kubewarden/kubewarden-controller/security/advisories/GHSA-6r7f-3fwq-hq74](https://github.com/kubewarden/kubewarden-controller/security/advisories/GHSA-6r7f-3fwq-hq74)

## Related threats

- [Kubewarden Missing Authorization in can_i host callback](https://junglewise.ai/threats/cve-2026-42541-kubewarden-missing-authorization-in-can-i-host-callback)
- [KubeWarden's AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources](https://junglewise.ai/threats/cve-2025-24376-kubewarden-s-admissionpolicy-and-admissionpolicygroup-policies)
- [Kubewarden-Controller information leak via AdmissionPolicyGroup Resource](https://junglewise.ai/threats/cve-2025-24784-kubewarden-controller-information-leak-via-admissionpolicygroup)