Kyverno क्रॉस-नेमस्पेस विशेषाधिकार वृद्धि पॉलिसी apiCall के माध्यम से github.com/kyverno/kyverno में

The core of this vulnerability lies within the apiCall functionality within Kyverno policies. An attacker can craft malicious policies that leverage this flaw to bypass existing security restrictions. This could enable them to perform actions they are not authorized to do, such as modifying critical resources, deploying unauthorized applications, or even gaining control of the entire cluster. The cross-namespace aspect significantly expands the potential blast radius, allowing an attacker to compromise multiple environments within a single cluster. This vulnerability shares similarities with other policy engine bypasses where improper validation of API calls leads to privilege escalation.

Organizations heavily reliant on Kyverno for Kubernetes policy enforcement are at significant risk. This includes those using Kyverno to enforce strict security policies, manage access control, or automate deployments. Shared Kubernetes environments and those with complex policy configurations are particularly vulnerable.

• linux / server:

journalctl -u kyverno -f | grep -i "apiCall"

• go / supply-chain: Inspect Kyverno policy files for instances of apiCall with potentially insecure configurations. Look for policies that allow unrestricted access to Kubernetes API resources. • generic web: Monitor Kubernetes API audit logs for unusual patterns of API calls originating from Kyverno pods, particularly those involving resource modifications or privilege escalations.

1. 2026-02-02Disclosure

   disclosure

1. आरक्षित2026-01-05
2. प्रकाशित2026-02-02
3. संशोधित2026-02-04
4. EPSS अद्यतन2026-03-23

The primary mitigation is to immediately upgrade Kyverno to version 1.15.3 or later. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider implementing stricter network policies to limit inter-namespace communication. Review existing Kyverno policies for any use of apiCall and ensure proper validation and authorization checks are in place. While a WAF or proxy cannot directly address this vulnerability, they can be configured to monitor for suspicious API calls originating from within the cluster. After upgrading, confirm the fix by verifying that policies utilizing apiCall are functioning as expected and that unauthorized actions are still blocked.