CVE-2025-24376: Kubewarden Privilege Escalation Vulnerability

CVE-2025-24376 Overview

CVE-2025-24376 affects kubewarden-controller, a Kubernetes controller that dynamically registers Kubewarden admission policies. The vulnerability allows an attacker with permission to create AdmissionPolicy or AdmissionPolicyGroup resources to target sensitive namespaced resources such as PolicyReport. An attacker can block the creation or update of PolicyReport objects to conceal non-compliant resources inside a namespace. A mutating AdmissionPolicy can also be abused to alter PolicyReport contents, undermining compliance visibility. The issue is tracked under [CWE-155] and was addressed in the Kubewarden controller 1.21.0 release with stricter validation rules.

Critical Impact
Attackers with policy creation rights can hide or tamper with compliance data by intercepting PolicyReport objects through admission policies.

Affected Products

kubewarden-controller (Kubernetes admission controller)
AdmissionPolicy custom resource
AdmissionPolicyGroup custom resource

Discovery Timeline

2025-01-30 - CVE-2025-24376 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24376

Vulnerability Analysis

Kubewarden's AdmissionPolicy and AdmissionPolicyGroup are designed to evaluate namespaced resources according to user-supplied rules. Before version 1.21.0, the controller did not restrict the set of namespaced resource types those policies could match. An operator with sufficient rights to create policies could therefore target resources whose integrity is essential for cluster security posture, such as PolicyReport objects produced by compliance tooling. The vulnerability is categorized as improper neutralization of parsed input elements [CWE-155].

Root Cause

The validation logic in api/policies/v1/policy_validation.go did not maintain a deny list of sensitive namespaced resources. Any combination of apiGroups and resources supplied inside a policy rule was accepted, including groups such as wgpolicyk8s.io that expose compliance state. This design gap allowed policies to intercept admission requests for resources they should never gate.

Attack Vector

An authenticated user with the ability to create Kubewarden policy objects registers an AdmissionPolicy or AdmissionPolicyGroup whose rules match PolicyReport or other sensitive types. The policy then rejects, silently drops, or mutates admission requests for those resources. This can be executed remotely over the Kubernetes API without user interaction, producing integrity and availability impact on cluster compliance data.

// Source: https://github.com/kubewarden/kubewarden-controller/commit/8124039b5f0c955d0ee8c8ca12d4415282f02d2c
// Patch adds a sensitiveResource type and matching logic used to reject
// AdmissionPolicy/AdmissionPolicyGroup rules that target protected resources.

const maxMatchConditionsCount = 64

type sensitiveResource struct {
    APIGroup string
    Resource string
}

func (sr sensitiveResource) String() string {
    return fmt.Sprintf("APIGroup: %s, Resource: %s", sr.APIGroup, sr.Resource)
}

func (sr sensitiveResource) MatchesRules(apiGroups []string, resource []string) bool {
    apiGroupMatches := false
    for _, apiGroup := range apiGroups {
        if apiGroup == sr.APIGroup || apiGroup == "*" {
            apiGroupMatches = true
            break
        }
    }

    resourceMatches := false
    for _, res := range resource {
        if res == sr.Resource || res == "*" || res == "*/*" || strings.HasPrefix(res, sr.Resource+"/") {
            resourceMatches = true
            break
        }
    }

    return apiGroupMatches && resourceMatches
}

Detection Methods for CVE-2025-24376

Indicators of Compromise

AdmissionPolicy or AdmissionPolicyGroup objects with rules referencing wgpolicyk8s.io API groups or the policyreports / clusterpolicyreports resources.
Unexpected drops or mutations in PolicyReport creation and update events emitted by compliance scanners such as Kyverno or Trivy.
Sudden decreases in reported non-compliant findings without a corresponding remediation history.

Detection Strategies

Audit all AdmissionPolicy and AdmissionPolicyGroup manifests for rules whose apiGroups or resources fields contain wildcards (*, */*) or reference policy reporting APIs.
Compare admission webhook decisions in kube-apiserver audit logs against expected PolicyReport write activity from compliance operators.
Track Kubewarden controller version across clusters and flag any deployment older than 1.21.0.

Monitoring Recommendations

Enable Kubernetes audit logging at RequestResponse level for the wgpolicyk8s.io API group and forward logs to a central analytics platform.
Alert on creation or modification of Kubewarden policy CRDs by non-platform service accounts.
Continuously reconcile expected PolicyReport counts per namespace against admission decisions to detect suppression.

How to Mitigate CVE-2025-24376

Immediate Actions Required

Upgrade kubewarden-controller to release 1.21.0 or later, which enforces stricter rule validation.
Review existing AdmissionPolicy and AdmissionPolicyGroup objects and remove any rules that target PolicyReport, ClusterPolicyReport, or other sensitive resources.
Restrict RBAC permissions for creating Kubewarden policy CRDs to trusted platform administrators.

Patch Information

The fix is delivered in the Kubewarden controller 1.21.0 release. Technical details are available in the GitHub Security Advisory GHSA-fc89-jghx-8pvg and the upstream commit 8124039, which introduces the sensitiveResource matcher used to reject unsafe policy rules at validation time.

Workarounds

Apply strict RBAC controls that limit create and update verbs on admissionpolicies.policies.kubewarden.io and admissionpolicygroups.policies.kubewarden.io to a small set of trusted principals.
Use a separate cluster-wide policy engine to validate incoming Kubewarden policy manifests and reject rules targeting compliance resources.
Monitor and alert on any PolicyReport write failures until the controller is upgraded to a fixed version.

bash

# Verify the installed Kubewarden controller version and identify risky policy rules
kubectl -n kubewarden get deploy kubewarden-controller \
  -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'

kubectl get admissionpolicies.policies.kubewarden.io -A -o json | \
  jq '.items[] | select(.spec.rules[]?.resources[]? | test("policyreports|clusterpolicyreports|\\*"))
       | {namespace: .metadata.namespace, name: .metadata.name, rules: .spec.rules}'

kubectl get admissionpolicygroups.policies.kubewarden.io -A -o json | \
  jq '.items[] | select(.spec.rules[]?.apiGroups[]? | test("wgpolicyk8s.io|\\*"))
       | {namespace: .metadata.namespace, name: .metadata.name, rules: .spec.rules}'