Executive brief
Kubewarden is a policy engine used to manage security and compliance within Kubernetes clusters. A vulnerability exists where an authorized user can bypass security restrictions to perform reconnaissance on the cluster's permissions. This allows an attacker to discover sensitive information about what actions different users and service accounts are allowed to perform, such as accessing secrets or creating resources, which could be used to plan further attacks.
Technical details
A missing authorization check in the Kubewarden 'can_i' host callback allows for RBAC reconnaissance. While other host capabilities like 'list_resources' enforce context-aware allow-lists via 'can_access_kubernetes_resource()', the 'can_i' callback forwards SubjectAccessReview (SAR) requests directly to the handler. This handler executes the SAR using the high-privileged identity of the Policy Server rather than the restricted context of the policy. An attacker with permissions to create AdmissionPolicies or AdmissionPolicyGroups can exploit this to enumerate permissions of any user or service account across the cluster. The issue is resolved in version 1.35.0 by introducing 'namespacedPoliciesCapabilities' to restrict host capability calls.
Affected products
- Kubewarden kubewarden-defaults < v1.35.0
Timeline
- 2026-04-27: advisory: GitHub advisory published by maintainers
- 2026-05-12: disclosed: CVE published to NVD