https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 00:44:57 +0000 https://vulnerability.circl.lu/vuln/ghsa-qjvc-p88j-j9rm <p><strong>Affected:</strong> Go: github.com/kyverno/kyverno</p> <p>### Summary A kyverno ClusterPolicy, ie. &#34;disallow-privileged-containers,&#34; can be overridden by the creation of a PolicyException in a random namespace.</p> <p>### Details By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions.</p> <p>### PoC 1. Administrator creates &#34;disallow-privileged-containers&#34; ClusterPolicy that applies to resources in the namespace &#34;ubuntu-restricted&#34; 2. Cluster user creates a PolicyException object for &#34;disallow-privileged-containers&#34; in namespace &#34;ubuntu-restricted&#34; 3. Cluster user creates a pod with a privileged container in &#34;ubuntu-restricted&#34; 4. Cluster user escalates to root on the node from the privileged container</p> <p>### Impact Administrators attempting to enforce cluster security through kyverno policies, but that allow less privileged users to create resources</p> <p><strong>Affected:</strong> Go: github.com/kyverno/kyverno</p> <p>### Summary A kyverno ClusterPolicy, ie. &#34;disallow-privileged-containers,&#34; can be overridden by the creation of a PolicyException in a random namespace.</p> <p>### Details By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions.</p> <p>### PoC 1. Administrator creates &#34;disallow-privileged-containers&#34; ClusterPolicy that applies to resources in the namespace &#34;ubuntu-restricted&#34; 2. Cluster user creates a PolicyException object for &#34;disallow-privileged-containers&#34; in namespace &#34;ubuntu-restricted&#34; 3. Cluster user creates a pod with a privileged container in &#34;ubuntu-restricted&#34; 4. Cluster user escalates to root on the node from the privileged container</p> <p>### Impact Administrators attempting to enforce cluster security through kyverno policies, but that allow less privileged users to create resources</p> https://vulnerability.circl.lu/vuln/ghsa-qjvc-p88j-j9rm