CVE-2026-54523

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54523
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54523.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54523
Aliases
Downstream
CGA (1)
MINI (4)
openSUSE (1)
SUSE (1)
Related
Published
2026-08-26T14:20:37Z
Modified
2026-10-28T02:30:36Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
Details

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54523.json"
}
References

Affected packages

Git / github.com/kyverno/kyverno

Affected ranges

Type
GIT
Repo
https://github.com/kyverno/kyverno
Events
Introduced
78e7560a5531fda5a39ffb119d7d8e47527d8aee
Fixed
945ac9ce8546ea6cd51370f24b615148c577da5e
Fixed
0919553c0ea1904f8d891280c92018da97946a06
Fixed
5164bcdeda5b57678bc2d7a03ecc2cbb02982dae
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.18.0"
                },
                {
                    "fixed": "1.18.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "0919553c0ea1904f8d891280c92018da97946a06"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "5164bcdeda5b57678bc2d7a03ecc2cbb02982dae"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.18.2",
            "range": [
                {
                    "fixed": "945ac9ce8546ea6cd51370f24b615148c577da5e"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}
Type
GIT
Repo
https://github.com/kyverno/sdk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6573937441443e1ba5af9fbb28d5c0f20297f9df
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "6573937441443e1ba5af9fbb28d5c0f20297f9df"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

kyverno-chart-3.*
kyverno-chart-3.8.0
kyverno-chart-3.8.1
kyverno-chart-3.8.1-rc.1
kyverno-chart-3.8.1-rc.2
kyverno-policies-chart-3.*
kyverno-policies-chart-3.8.0
kyverno-policies-chart-3.8.1
kyverno-policies-chart-3.8.1-rc.1
kyverno-policies-chart-3.8.1-rc.2
v1.*
v1.18.0
v1.18.1
v1.18.1-rc.1
v1.18.1-rc.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54523.json"