CVE-2025-46342: Kyverno Auth Bypass Vulnerability

CVE-2025-46342 Overview

CVE-2025-46342 is a policy bypass vulnerability in Kyverno, a policy engine for cloud native platform engineering teams running on Kubernetes. Versions prior to 1.13.5 and 1.14.0 fail to propagate errors from the GetNamespaceSelectorsFromNamespaceLister function in pkg/utils/engine/labels.go. Policy rules that rely on namespace selectors in their match statements are silently skipped during admission review processing. Attackers with Kubernetes API access can bypass security-critical mutations and validations, executing malicious operations that should have been blocked. The flaw is tracked under CWE-1287 — Improper Validation of Specified Type of Input.

Critical Impact
Admission control policies bound by namespace selectors fail open, allowing attackers with Kubernetes API access to deploy non-compliant workloads that violate organizational security guardrails.

Affected Products

Kyverno versions prior to 1.13.5
Kyverno versions prior to 1.14.0
Kubernetes clusters relying on Kyverno admission policies with namespace selectors

Discovery Timeline

2025-04-30 - CVE-2025-46342 published to the National Vulnerability Database
2025-05-16 - Last updated in the NVD database

Technical Details for CVE-2025-46342

Vulnerability Analysis

Kyverno enforces Kubernetes policy through a validating and mutating admission webhook. When the API server receives a request, Kyverno evaluates configured policies and either admits, mutates, or rejects the operation. Many policies scope their applicability using namespace selectors that match labels on the target namespace.

The defect resides in GetNamespaceSelectorsFromNamespaceLister inside pkg/utils/engine/labels.go. The function retrieves namespace labels needed to evaluate selectors but discards any error returned by the underlying lister. When the lookup fails, the function returns an empty label set instead of signaling the error to the caller. The engine then concludes the selector does not match and skips the rule entirely. Security-critical validations and mutations never execute, and the offending request is admitted by default.

Root Cause

The root cause is missing error propagation from the namespace lister call chain. Errors that should halt or fail policy evaluation are swallowed, producing a fail-open behavior. This violates the principle that admission controllers must fail closed when they cannot evaluate a policy. The patch in commit 3ff923b7756e1681daf73849954bd88516589194 returns the error to the caller so the engine can react appropriately.

Attack Vector

An attacker requires Kubernetes API access with sufficient permissions to submit resources to namespaces governed by selector-based Kyverno policies. By triggering conditions that cause the namespace label lookup to return an error, the attacker forces Kyverno to skip the matching policy. The attacker then submits workloads, pods, or RBAC objects that would normally violate organizational policy. Bypassed controls may include privileged container restrictions, image registry allowlists, network policy mandates, and resource quotas.

No public proof-of-concept exploit is currently available, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-46342

Indicators of Compromise

Resources admitted into namespaces despite matching Kyverno policy rules that should have rejected or mutated them
Kyverno admission controller logs showing empty namespace label sets during policy evaluation
Workloads running with privileged settings, hostPath mounts, or non-approved images in namespaces protected by selector-scoped policies
Discrepancies between expected PolicyReport results and admitted resources in selector-targeted namespaces

Detection Strategies

Audit Kyverno controller and webhook logs for warnings related to namespace lister failures or skipped policy evaluations
Compare admitted Kubernetes resources against the expected outcomes defined by namespace-selector-based policies
Query the Kubernetes audit log for admission decisions on resources that should have triggered policy enforcement
Run synthetic policy tests across namespaces to confirm selector-based rules execute as configured

Monitoring Recommendations

Forward Kyverno controller logs and Kubernetes audit logs to a centralized SIEM for correlation
Alert on the absence of expected PolicyReport entries for resources created in namespaces covered by selector policies
Track the Kyverno version deployed in each cluster and flag installations below 1.13.5 or 1.14.0
Monitor for spikes in admission requests targeting namespaces with sensitive selector-based policies

How to Mitigate CVE-2025-46342

Immediate Actions Required

Upgrade Kyverno to version 1.13.5 or 1.14.0 or later across all clusters
Inventory existing policies that use namespaceSelector in their match statements and prioritize patching clusters that rely on them
Review Kubernetes audit logs since the Kyverno installation date for resources that may have bypassed selector-scoped policies
Restrict Kubernetes API access using RBAC to limit which principals can submit workloads to sensitive namespaces

Patch Information

The Kyverno maintainers released fixes in versions 1.13.5 and 1.14.0. The fix is implemented in commit 3ff923b and documented in the GitHub Security Advisory GHSA-jrr2-x33p-6hvc. The patch ensures GetNamespaceSelectorsFromNamespaceLister propagates lister errors to callers so policy evaluation fails closed.

Workarounds

Convert selector-based match statements to explicit namespace lists where feasible until patching is complete
Add redundant cluster-scoped policies that enforce the same controls without depending on namespace selectors
Tighten RBAC to limit which service accounts and users can create resources in policy-protected namespaces
Deploy network policies and Pod Security Admission as defense-in-depth controls independent of Kyverno

bash

# Upgrade Kyverno via Helm to a patched release
helm repo update
helm upgrade kyverno kyverno/kyverno \
  --namespace kyverno \
  --version 3.3.5

# Verify the running version meets the patched baseline
kubectl -n kyverno get deploy kyverno-admission-controller \
  -o jsonpath='{.spec.template.spec.containers[0].image}'