DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54523: CVE-2026-54523: Privilege Escalation via Cross-Namespace Resource Generation in Kyverno

#security #cve #cybersecurity

CVE-2026-54523: Privilege Escalation via Cross-Namespace Resource Generation in Kyverno

Vulnerability ID: CVE-2026-54523
CVSS Score: 9.6
Published: 2026-08-26

CVE-2026-54523 is a critical security vulnerability in the Kyverno policy engine (versions 1.18.0 up to 1.18.2) where the CEL generator library fails to validate target namespace boundaries. This allows unprivileged tenants with namespace-scoped policy creation permissions to bypass Kubernetes multi-tenancy limits and execute unauthorized cross-namespace resource creation, potentially escalating privileges to cluster administrator.

TL;DR

A missing authorization check in Kyverno's CEL policy compiler allows namespace-scoped users to generate arbitrary resources in other namespaces, leading to cluster privilege escalation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862: Missing Authorization
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 9.6 (Critical)
  • Exploit Status: PoC available in test suites, no known in-the-wild exploitation
  • KEV Status: Not listed on CISA KEV
  • Impact: Complete cluster-wide privilege escalation and arbitrary write access

Affected Systems

  • Kyverno (Core and SDK components)
  • Kyverno: >= 1.18.0, < 1.18.2 (Fixed in: 1.18.2)

Code Analysis

Commit: 6573937

Enforce namespace-scoping in SDK CEL generator library

Commit: 0919553

Fix cross-namespace generation in mutating and generating policies

Commit: 5164bcd

Enforce namespace constraints and block cluster-scoped resources in context provider

Mitigation Strategies

  • Upgrade Kyverno to version 1.18.2 or later to enforce namespace validation within the compiler.
  • Restrict RBAC permissions for NamespacedGeneratingPolicy and NamespacedMutatingPolicy creation to cluster administrators.
  • Audit existing namespaced policies for instances of the generator.apply function targeting external namespaces.

Remediation Steps:

  1. Query the cluster to identify currently running Kyverno deployment versions.
  2. Upgrade Kyverno core components to 1.18.2 or above via Helm or static manifests.
  3. Scan existing policy resources in all namespaces for occurrences of generator.apply using automated scripts.
  4. Modify Kubernetes Role and RoleBinding definitions to remove policy-creation privileges from general tenants.

References

Read the full report for CVE-2026-54523 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)