| GHSA-2r43-6962-xcw5 | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller, reports-controller, cleanup-controller | The image verification cache keyed a prior pass verdict on the image reference string, which could be a bare tag. Because a registry can repoint a tag, a verdict earned by one image could later be served for a different image pushed to the same tag. Fixed by refusing to store or serve any cache entry whose reference is not digest-pinned, and by resolving the digest before deriving the key. |
| GHSA-3xfv-vq8x-qhg4 | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller, reports-controller, cleanup-controller | A namespaced Policy apiCall validated the urlPath against the whole string, query and fragment included, but executed only the parsed path, so validation and execution disagreed on the target. A decoy /namespaces// segment hidden in a query or fragment satisfied the namespace clamp while the request reached a cluster-scoped endpoint, letting a tenant create cluster-scoped objects (for example MutatingWebhookConfigurations) as the Kyverno ServiceAccount and escalate toward cluster admin. Fixed by canonicalizing the urlPath, validating the path component alone, and executing the exact validated canonical path; the follow-up anchors the namespace clamp to the fixed path position so a positional decoy cannot satisfy it either (on this branch as b0095623b5 and 1d90608ffc). |
| GHSA-4pqm-wqq6-h9q2 | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Namespaced CEL policy helpers (resource.get, resource.list, and resource.post) passed their resource, group, and version arguments to the Kubernetes dynamic client, which builds the request path by joining segments. The client validates the namespace and object name but not these arguments, so a ‘..’ or an embedded slash in the resource argument could redirect a request to another namespace or to a cluster-scoped path. Because this line ships namespaced CEL policies, a policy author confined to one namespace could reach objects in other namespaces or at cluster scope, served with the Kyverno controller’s permissions. Fixed by validating every path segment derived from a policy argument and rejecting empty, ‘.’, ‘..’, and slash- or backslash-injected segments before any request is issued. Commit 34def2edfc86922ecf0b8ee6049d9a236aad6691 on release-1.17-n4k. |
| GHSA-5qq8-67g6-4h2w | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller, reports-controller, cleanup-controller | A namespaced Policy’s apiCall urlPath was clamped to the policy’s own namespace by normalising the path before comparing it, but the normalisation did not decode percent-encoded characters. Encoded dot-segments therefore survived normalisation and escaped the clamp, letting a namespace tenant read resources in other namespaces and create cluster-scoped objects as the admission controller’s ServiceAccount. The fix decodes the path once before normalising it, so validation sees the same path the API server would. Cluster-scoped policies are unaffected. Commit 1b3a6ee92. |
| GHSA-p58h-r4j3-h5vx | github.com/kyverno/kyverno | Critical | Code change | kyverno, cleanup-controller | The cleanup controller built its context loader without the policy’s own scope, so a namespaced CleanupPolicy’s context entries were treated as cluster scoped and were not confined to the policy’s namespace. The fix passes the real policy to the context loader factory, so a namespaced CleanupPolicy resolves apiCall and configMap context only within its own namespace, and rejects global references at both admission and runtime. Enterprise commits e23bb34a90 and 1777dd9247 on this branch. |
| GHSA-rcxg-3f92-3mgr | github.com/kyverno/kyverno | Critical | Code change | kyverno, cleanup-controller | A namespaced CleanupPolicy could issue apiCall context requests to paths outside its own namespace. The fix validates the apiCall path and confines it to the policy’s namespace, rejecting cross-namespace and cluster-scoped requests before they are sent. Cluster-scoped CleanupPolicy behavior is unchanged. Enterprise commits e23bb34a90 and 1777dd9247 on this branch. |
| GHSA-24cc-9745-hxfc | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Unchecked type assertions on remote attestation and OCI manifest JSON panicked on a non-string type field, bypassing image verification and crash-looping the reports controller. Fixed by reading those fields through a checked accessor that returns an error, so malformed remote data fails closed. |
| GHSA-338x-hgrv-626h | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Variable substitution re-scanned already-substituted text, so nested or self-referential values could drive unbounded re-scanning. Fixed by bounding substitution to the author’s own template spans, with alias-hop and total-substitution limits. The substitution mitigation was completed on this line in v1.17.2-n4k.nirmata.22 by two further changes: a per-document output-size cap that also accounts whole-leaf “{ var }” substitutions, and a rewrite that resolves each substitution pass in linear time, closing a worst case where a policy whose substituted output stayed under the size cap could still consume the admission webhook’s time budget. |
| GHSA-3f2c-hfj8-542w | github.com/kyverno/kyverno | High | Code change | kyverno, reports-controller | Notary attestation statement extraction checked the compressed descriptor and layer size against the 10 MB payload limit but read the decompressed predicate into memory without a bound, so an attacker-supplied referrer artifact that compresses small and expands large could exhaust admission controller memory; fixed by reading layers through a shared helper that decompresses under a bounded decoder and caps the decompressed output at the same limit (on this branch as f99d9d1d5). The same payload bound was completed in v1.17.2-n4k.nirmata.22: the limit is now configurable behind –imageVerifyPayloadLimit (default unchanged at 10000000 bytes, raise-or-tighten but never disabled), so a legitimately large compressed attestation predicate can be allowed rather than refused outright; size refusals now carry a sentinel error so a refused bundle referrer is logged where an operator sees it; and the referrers index body is bounded to 1 MB before the unmarshal that allocates it, closing a path where a 34 MB index allocated roughly 400 MB while being rejected. |
| GHSA-59v6-2x73-wfg4 | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | A policy scoped to a single namespace could read the full contents of a cluster-scoped GlobalContextEntry, including data cached from namespaces the policy’s tenant has no permission to read. This affected both the CEL globalContext library in namespaced policy types and the legacy globalReference context entry, neither of which was confined to the policy’s namespace the way the sibling resource, http and configMap lookups already were. The fix rejects both forms in namespaced policies at admission and denies the lookup at evaluation time, leaving cluster-scoped policies unchanged. Commit e2f787ebc. |
| GHSA-5cjf-wwfg-pj4c | github.com/kyverno/kyverno | High | Code change | kyverno | The ImageValidatingPolicy evaluator ignored a PolicyException’s spec.images and spec.allowedValues fields. Any exception whose policyRefs and matchConditions matched a resource skipped image signature verification for the entire resource rather than only for the images or values it listed, so an exception intended to exempt one trusted image exempted every image on that resource. ValidatingPolicy, GeneratingPolicy and MutatingPolicy already treated the same fields as a partial exemption. The fix skips evaluation only for a true full exemption, leaving partial exceptions to be evaluated normally. Commit d8b142900. |
| GHSA-8mrj-27wr-599g | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | The wildcard glob matcher used a recursive algorithm whose running time could grow exponentially with pattern length, so a crafted policy or resource string could stall policy evaluation. Fixed by replacing it with a linear two-pointer matcher bounded by a per-call work budget, plus length caps on wildcard fields at policy admission. |
| GHSA-c5qq-7g2q-cpqp | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | A namespaced Policy’s apiCall urlPath was clamped to the policy’s own namespace by normalising the path before comparing it, but the normalisation did not decode percent-encoded characters. Encoded dot-segments therefore survived normalisation and escaped the clamp, letting a namespace tenant read resources in other namespaces and create cluster-scoped objects as the admission controller’s ServiceAccount. The fix decodes the path once before normalising it, so validation sees the same path the API server would. Cluster-scoped policies are unaffected. Commit 1b3a6ee92. |
| GHSA-fcfr-fr8g-qjqv | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | A cosign signing certificate with no subject alternative name caused the configured subject and subjectRegExp identity check to be skipped rather than failing, so a certificate carrying no identity satisfied a policy that pinned one. Fixed by failing closed when a subject constraint is configured and the certificate has no subject alternative name. |
| GHSA-fr24-3hvf-393q | github.com/kyverno/kyverno | High | Code change | kyverno, reports-controller | Notary signature blob fetching applied the same compressed-only size check and buffered the decompressed signature layer without a bound, giving the same memory-exhaustion path during image verification; fixed by the same bounded-decoder helper, which also covers the cosign bundle read and the image verification referrer loader, and by rejecting a signature manifest that declares no layers instead of indexing it and panicking (on this branch as f99d9d1d5). The same payload bound was completed in v1.17.2-n4k.nirmata.22: the limit is now configurable behind –imageVerifyPayloadLimit (default unchanged at 10000000 bytes, raise-or-tighten but never disabled), so a legitimately large compressed attestation predicate can be allowed rather than refused outright; size refusals now carry a sentinel error so a refused bundle referrer is logged where an operator sees it; and the referrers index body is bounded to 1 MB before the unmarshal that allocates it, closing a path where a 34 MB index allocated roughly 400 MB while being rejected. |
| GHSA-h3pm-q9ww-f439 | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | The validating webhook trusted the verify-images annotation written by the mutating webhook, so a request that set the annotation directly, or replayed it on UPDATE, was admitted without verification. Fixed by having the validating handler re-verify independently; the annotation is now informational only and is no longer read as a verdict. |
| GHSA-pcx2-xcq4-65vf | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | The same validate/execute divergence in a namespaced Policy apiCall urlPath let a query- or fragment-hidden decoy namespace segment pass the namespace clamp while the request read resources in a different namespace as the Kyverno ServiceAccount. Fixed by the same canonicalize-then-validate-the-path-only change and the anchored namespace clamp (on this branch as b0095623b5 and 1d90608ffc). |
| GHSA-qc9c-3fgf-cgq8 | github.com/kyverno/kyverno | High | Code change | kyverno | The admission-policy generator folded PolicyExceptions into generated ValidatingAdmissionPolicy and MutatingAdmissionPolicy resources without applying the gates runtime enforcement uses, so an exception the engine would reject still took effect in the generated native policy. The generator now applies the –enablePolicyException flag, –exceptionNamespace scoping, and policyRefs kind matching, delegating to the same helpers the CEL engines call. That initial fix left a same-class sink open, closed in v1.17.2-n4k.nirmata.22: the generator rendered an exception’s spec.images and spec.allowedValues into the generated policy’s CEL variable expressions by string concatenation, so a value containing a single quote escaped the string literal and became expression code — a crafted entry widened the allowed-image list to whatever image was under review. Both lists are now encoded as CEL literals instead of built as expression text (PR #1288). |
| GHSA-r2p2-3892-5jjf | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | An unchecked type assertion in the In and NotIn operators could panic on a non-string key element. Fixed by routing In-family comparison through a shared element primitive that handles non-string elements safely. |
| GHSA-x4xq-p8g4-6fwg | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | An unchecked type assertion to string on a substituted or admission-supplied value could panic the engine or the policy-validation webhook. Fixed by guarding those assertions and degrading to an explicit error or a stringified fallback. |
| GHSA-m8p2-qqmx-j53x | github.com/kyverno/kyverno | Medium | Code change | kyverno, background-controller, reports-controller, cleanup-controller | CEL policy expressions were compiled without a cost limit, so the work one expression could do was unbounded and a policy author could exhaust a shared controller. Enabling cel-go’s cost limit alone does not help, because cel-go prices O(n) operations by resolved overload ID and Kyverno declares its resource variables as dyn, so every such call is billed a flat 1 unit; fixed by pricing calls by function name, refusing operations whose predicted output exceeds a size cap before they run, and metering the total cost of one request, all delivered as environment-level program options so every policy family and the legacy kyverno.io/v1 CEL path inherit them. Backport of upstream PR #1028 and its three follow-ups. That initial fix left three same-class vectors open, closed in v1.17.2-n4k.nirmata.22: lists.range allocated its whole result in one step before the post-hoc charge could bound it, now refused pre-execution by an element-count guard; a constant-pattern findAll bypassed its target-size guard because the apiserver’s regex optimizer rebuilt the call node after the guard wrapped it, now shadowed so the guarded node is kept; and size() on a large string was exempt from pricing despite its O(n) scan, now charged for the scan (PR #1240). |
