CVE-2026-42541: Kubewarden Missing Authorization in can_i host callback

CVE-2026-42541 · Severity: medium · CVSS 4.3 · Published 2026-05-12

Kubewarden is a policy engine used to manage security and compliance within Kubernetes clusters. A vulnerability exists where an authorized user can bypass security restrictions to perform reconnaissance on the cluster's permissions. This allows an attacker to discover sensitive information about what actions different users and service accounts are allowed to perform, such as accessing secrets or creating resources, which could be used to plan further attacks.

Technologies: github.com/kubewarden/kubewarden-controller (Go). Vendors: Go.

Quick answers

Is CVE-2026-42541 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42541 being exploited in the wild.
How severe is CVE-2026-42541?
Medium severity, with a CVSS score of 4.3, published 12 May 2026.
Which products and versions are affected?
github.com/kubewarden/kubewarden-controller (Go) < 1.35.0, SEMVER:introduced=0,fixed=1.35.0; Kubewarden Controller < 1.35.0; Kubewarden-Defaults < v1.35.0.
Is there a fix for CVE-2026-42541?
Yes. github.com/kubewarden/kubewarden-controller (Go): upgrade to 1.35.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42541 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42541?
Check whether you run github.com/kubewarden/kubewarden-controller (Go), Kubewarden Controller or Kubewarden-Defaults at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/kubewarden/kubewarden-controller (Go): upgrade to 1.35.0 or later
    go get github.com/kubewarden/kubewarden-controller@v1.35.0

Technical details

A missing authorization check in the Kubewarden 'can_i' host callback allows for RBAC reconnaissance. While other host capabilities like 'list_resources' enforce context-aware allow-lists via 'can_access_kubernetes_resource()', the 'can_i' callback forwards SubjectAccessReview (SAR) requests directly to the handler. This handler executes the SAR using the high-privileged identity of the Policy Server rather than the restricted context of the policy. An attacker with permissions to create AdmissionPolicies or AdmissionPolicyGroups can exploit this to enumerate permissions of any user or service account across the cluster. The issue is resolved in version 1.35.0 by introducing 'namespacedPoliciesCapabilities' to restrict host capability calls.

Affected products

  • Kubewarden kubewarden-defaults < v1.35.0

Identifiers

  • CVE-2026-42541
  • GHSA-wqcw-g35j-j578
  • GO-2026-5716

Timeline

  • 2026-04-27: advisory: GitHub advisory published by maintainers
  • 2026-05-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.