CVE-2026-54523

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54523", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T18:40:01.651Z", "datePublished": "2026-08-26T14:20:37.236Z", "dateUpdated": "2026-08-26T15:06:37.284Z"}, "containers": {"cna": {"title": "Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9"}, {"name": "https://github.com/kyverno/kyverno/pull/16238", "tags": ["x_refsource_MISC"], "url": "https://github.com/kyverno/kyverno/pull/16238"}, {"name": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06", "tags": ["x_refsource_MISC"], "url": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06"}, {"name": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae", "tags": ["x_refsource_MISC"], "url": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae"}, {"name": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df", "tags": ["x_refsource_MISC"], "url": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df"}, {"name": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2"}], "affected": [{"vendor": "kyverno", "product": "kyverno", "versions": [{"version": ">= 1.18.0, < 1.18.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-26T14:20:55.122Z"}, "descriptions": [{"lang": "en", "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2."}], "source": {"advisory": "GHSA-79gf-7frw-68m9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T15:06:17.140283Z", "id": "CVE-2026-54523", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T15:06:37.284Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54523", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T15:06:17.140283Z"}}}], "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T15:06:09.636Z"}}], "cna": {"title": "Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system", "source": {"advisory": "GHSA-79gf-7frw-68m9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kyverno", "product": "kyverno", "versions": [{"status": "affected", "version": ">= 1.18.0, < 1.18.2"}]}], "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9", "name": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kyverno/kyverno/pull/16238", "name": "https://github.com/kyverno/kyverno/pull/16238", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06", "name": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae", "name": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df", "name": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2", "name": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-26T14:20:55.122Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54523", "state": "PUBLISHED", "dateUpdated": "2026-08-26T15:06:37.284Z", "dateReserved": "2026-06-15T18:40:01.651Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-26T14:20:37.236Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kyverno", "vendor": "kyverno", "versions": [{"status": "affected", "version": ">= 1.18.0, < 1.18.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2."}], "id": "CVE-2026-54523", "lastModified": "2026-09-09T21:09:13.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54523", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T15:06:17.140283Z", "version": "2.0.3"}}]}, "published": "2026-08-26T15:16:48.910", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06"}, {"source": "security-advisories@github.com", "url": "https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae"}, {"source": "security-advisories@github.com", "url": "https://github.com/kyverno/kyverno/pull/16238"}, {"source": "security-advisories@github.com", "url": "https://github.com/kyverno/kyverno/releases/tag/v1.18.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9"}, {"source": "security-advisories@github.com", "url": "https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/kyverno/kyverno: kyverno: Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system", "id": "2524413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524413"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-862", "details": ["Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.", "A flaw was found in Kyverno, a policy engine for cloud-native platforms. A user with specific permissions to create policy objects in one area (namespace) can exploit a vulnerability where a namespace argument is not properly checked. This allows them to force the system's admission controller, which has broad access, to create resources like user role assignments (RoleBindings) in other restricted areas. This can lead to unauthorized changes and potentially elevate their access privileges within the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-54523", "public_date": "2026-08-26T14:20:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54523\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54523\nhttps://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06\nhttps://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae\nhttps://github.com/kyverno/kyverno/pull/16238\nhttps://github.com/kyverno/kyverno/releases/tag/v1.18.2\nhttps://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9\nhttps://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df"], "statement": "This Important vulnerability in Kyverno allows for privilege escalation due to improper validation of namespace arguments in NamespacedMutatingPolicy objects. However, Red Hat products, including Konflux components, are not affected by this flaw as the vulnerable code is not present in their deployments.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.18.0,1.18.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kyverno", "source": "cna", "vendor": "kyverno"}, "product": "kyverno", "vendor": "kyverno"}], "created": "2026-08-26T17:15:04.616386+00:00", "updated": "2026-08-26T19:30:05.027113+00:00", "vendors": ["kyverno", "kyverno$PRODUCT$kyverno"]}