IBM Portieris Image Policy Enforcement Bypass

IBM Portieris, an admission controller for Kubernetes designed to enforce image security policies, contains a vulnerability (CVE-2026-18544) in versions 0.5.0 through 0.14.2. This flaw stems from improper authorization of pod owner references, classified under CWE-862 (Missing Authorization).

The vulnerability allows a remote authenticated user with access to the cluster to circumvent configured image security policies. By manipulating the pod owner references during deployment requests, an attacker can trick the admission controller into bypassing checks that would normally prevent the execution of unauthorized or non-compliant container images. This effectively neutralizes the security controls intended to ensure only verified, trusted images are run within the Kubernetes environment, potentially allowing the execution of malicious or vulnerable code.

Impact

The vulnerability carries a CVSS 3.1 base score of 8.1, reflecting its high impact on confidentiality and integrity. If successfully exploited, an attacker could deploy arbitrary images that violate organizational security posture, facilitating unauthorized access or persistence within the containerized infrastructure.

Recommendation

• Apply the security update provided by IBM in the official support bulletin to address CVE-2026-18544.
• Audit existing Kubernetes admission controller configurations to ensure that pod owner references are strictly validated.
• Monitor Kubernetes audit logs for suspicious or unauthorized image deployment attempts that bypass expected policy enforcement.
• Ensure Kubernetes RBAC is restricted to limit the ability of authenticated users to modify pod specifications or influence pod owner references.