CVE-2025-46342

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-46342
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-46342.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-46342
Aliases
Downstream
Related
Published
2025-04-30T14:55:13Z
Modified
2025-11-04T20:37:01.639290Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements
Details

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function GetNamespaceSelectorsFromNamespaceLister in pkg/utils/engine/labels.go. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0.

Database specific 
{
    "cwe_ids": [
        "CWE-1287"
    ]
}
References

Affected packages

Git / github.com/kyverno/kyverno

Affected ranges

Type
GIT
Repo
https://github.com/kyverno/kyverno
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a08b3fbead8235f84f6443b2d860f8fef143c756
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.13.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/kyverno/kyverno
Events
Introduced
1d276d71bc62d2ec17184f80821fbead34d6aff7
Fixed
338a72c59ddd055a3ad8aaae511bafa742608641
Database specific 
{
    "versions": [
        {
            "introduced": "1.14.0-alpha.1"
        },
        {
            "fixed": "1.14.0"
        }
    ]
}

Affected versions

1.*

1.3.0-rc10
1.6-dev
1.7-dev
1.8-dev
1.9-dev

helm-chart-v2.*

helm-chart-v2.0.3
helm-chart-v2.0.3-rc1
helm-chart-v2.0.3-rc2
helm-chart-v2.1.0
helm-chart-v2.1.3

kyverno-chart-3.*

kyverno-chart-3.3.0
kyverno-chart-3.3.0-beta.1
kyverno-chart-3.3.0-rc.1
kyverno-chart-3.3.0-rc.2
kyverno-chart-3.3.0-rc.3
kyverno-chart-3.3.1
kyverno-chart-3.3.2
kyverno-chart-3.3.3
kyverno-chart-3.3.3-rc.1
kyverno-chart-3.3.4
kyverno-chart-3.3.4-rc.1
kyverno-chart-3.3.5
kyverno-chart-3.3.6
kyverno-chart-3.3.7
kyverno-chart-3.4.0-alpha.1
kyverno-chart-3.4.0-rc.1

kyverno-policies-chart-3.*

kyverno-policies-chart-3.3.0
kyverno-policies-chart-3.3.0-beta.1
kyverno-policies-chart-3.3.0-rc.1
kyverno-policies-chart-3.3.0-rc.2
kyverno-policies-chart-3.3.0-rc.3
kyverno-policies-chart-3.3.1
kyverno-policies-chart-3.3.1-rc.1
kyverno-policies-chart-3.3.2
kyverno-policies-chart-3.3.2-rc.1
kyverno-policies-chart-3.3.3
kyverno-policies-chart-3.3.4
kyverno-policies-chart-3.4.0-alpha.1
kyverno-policies-chart-3.4.0-rc.1

Other

test-dev

v0.*

v0.1.0
v0.10.0
v0.11.0
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.7.1
v0.8.0
v0.9.0
v0.9.1

v1.*

v1.0.0
v1.0.0-rc1
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.2
v1.1.3
v1.1.3-rc1
v1.1.4
v1.1.4-rc1
v1.1.5
v1.1.6
v1.1.6-rc1
v1.1.6-rc2
v1.1.6-rc3
v1.1.6-rc4
v1.1.6-rc5
v1.1.7
v1.1.7-rc1
v1.1.7-rc2
v1.1.7-rc3
v1.1.7-rc4
v1.1.8
v1.1.9
v1.13.0
v1.13.0-beta.1
v1.13.0-rc.1
v1.13.0-rc.2
v1.13.0-rc.3
v1.13.1
v1.13.1-rc.1
v1.13.2
v1.13.2-rc.1
v1.13.3
v1.13.4
v1.14.0-alpha.1
v1.14.0-rc.1
v1.2.0
v1.2.1
v1.3.0
v1.3.0-rc1
v1.3.0-rc10
v1.3.0-rc11
v1.3.0-rc12
v1.3.0-rc2
v1.3.0-rc3
v1.3.0-rc4
v1.3.0-rc5
v1.3.0-rc6
v1.3.0-rc7
v1.3.0-rc8
v1.3.0-rc9
v1.3.1
v1.3.2
v1.3.2-rc1
v1.3.2-rc2
v1.3.2-rc3
v1.3.3
v1.3.4
v1.3.4-rc1
v1.3.5
v1.3.5-rc1
v1.3.5-rc2
v1.3.5-rc3
v1.3.5-rc4
v1.3.5-rc5
v1.3.6
v1.3.6-rc1
v1.3.6-rc2
v1.3.6-rc3
v1.3.6-rc4
v1.3.6-rc5
v1.4.0
v1.4.0-rc1
v1.4.0-rc2
v1.4.0-rc3
v1.4.0-rc4
v1.4.1
v1.4.2
v1.4.2-rc1
v1.4.2-rc2
v1.4.2-rc3
v1.4.2-rc4
v1.4.3
v1.4.3-rc1
v1.4.3-rc2
v1.5.0-rc1