Executive brief
Kyverno is a policy enforcement tool for Kubernetes clusters used to prevent unauthorized resource configurations. A flaw in its exception handling allows attackers to bypass security policies by crafting resource names that match less restrictive exceptions, potentially enabling forbidden workloads like those with hostPath volume access. This can lead to privilege escalation, data exposure, or operational compromise on affected clusters.
Technical details
This vulnerability exists in Kyverno's PolicyException handling logic when multiple exceptions are defined for a single enforce-mode policy. The bug causes the engine to incorrectly prioritize a less restrictive exception over a more restrictive one, allowing policy bypass. An attacker with low cluster privileges can craft a resource name matching the second exception's pattern (e.g., containing "ingress") to circumvent security policies such as disallowing hostPath volumes. The flaw requires the attacker to have adjacent network access and low privileges but no user interaction. Patches are available in Kyverno v1.13.0 and later.
Affected products
- Kyverno Kyverno v1.9.0 through v1.12.7
Timeline
- 2026-01-06: disclosed
- 2026-01-06: patched: Patched in v1.13.0
- 2026-09-01: advisory