Because the admission controller executes these operations with cluster-wide privileges, an attacker can effectively bypass Kubernetes namespace isolation. The root cause is the lack of namespace scope enforcement in pkg/cel/policies/mpol/validate.go, leaving the generator.apply() function susceptible to cross-namespace resource injection during admission processing.

Attack Chain

1. Attacker obtains create permissions on namespacedmutatingpolicies.policies.kyverno.io within a non-privileged namespace (e.g., tenant-ns).
2. Attacker crafts a malicious NamespacedMutatingPolicy object targeting standard resources like ConfigMaps.
3. Attacker inserts a matchConditions block containing a CEL expression that invokes generator.apply("target-namespace", [resources]).
4. Attacker specifies a sensitive destination namespace (e.g., kube-system) as the first argument in the generator.apply function.
5. Attacker creates a legitimate resource (e.g., a ConfigMap) in tenant-ns to trigger the Kyverno admission webhook.
6. The admission controller parses the NamespacedMutatingPolicy and executes the generator.apply function at request time.
7. The controller, operating with cluster-wide service account privileges, creates the attacker-defined resource in the target namespace.
8. Final objective is achieved, such as injecting malicious configuration, disrupting network policy, or escalating privileges via unauthorized RoleBinding creation.

Impact

Successful exploitation allows for full namespace breakout and privilege escalation within the Kubernetes cluster. An attacker can inject unauthorized configuration into protected namespaces, modify network traffic flow via NetworkPolicies, or create elevated RoleBindings to gain persistent administrative access. Any Kubernetes cluster running Kyverno v1.18.0 or v1.18.1 that permits non-admin users to manage NamespacedMutatingPolicy resources is vulnerable to complete compromise.

Recommendation

• Immediately upgrade Kyverno to a patched version that enforces namespace validation for the generator library.
• Audit all existing NamespacedMutatingPolicy objects for matchConditions blocks containing generator.apply() calls.
• Restrict RBAC permissions for creating NamespacedMutatingPolicy resources to highly trusted service accounts or cluster administrators until the patch is applied.
• Implement Admission Controller logging to monitor for resource creation events originating from NamespacedMutatingPolicy triggers in sensitive namespaces.