CyberRota Analysis
AI-GeneratedVersions v1.9.0 through v1.12.7 of Kyverno are vulnerable due to a policy exception handling flaw that allows attackers to bypass security policies by exploiting the precedence of PolicyExceptions. This vulnerability can lead to unauthorized access or manipulation of resources, particularly in environments enforcing critical policies like hostPath volume restrictions. Organizations using affected versions should prioritize upgrading to v1.13.0 to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.