CVE-2026-29773: Kubewarden Privilege Escalation Flaw

CVE-2026-29773 Overview

CVE-2026-29773 is an authorization bypass vulnerability in Kubewarden, a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy namespaced AdmissionPolicies and AdmissionPolicyGroups in their Namespaces. One of Kubewarden's promises is that configured users can deploy namespaced policies in a safe manner, without privilege escalation. However, an attacker with privileged "AdmissionPolicy" create permissions (which isn't the default) could exploit three deprecated host-callback APIs: kubernetes/ingresses, kubernetes/namespaces, and kubernetes/services. By crafting a malicious policy that exercises these deprecated API calls, an attacker could gain unauthorized read access to Ingresses, Namespaces, and Services resources.

Critical Impact

Unauthorized read access to Kubernetes cluster resources (Ingresses, Namespaces, Services) through deprecated API callbacks, enabling information disclosure in multi-tenant Kubernetes environments.

Affected Products

• Kubewarden Controller (versions prior to security patch)
• Kubewarden policy engine deployments with namespaced AdmissionPolicy permissions enabled

Discovery Timeline

• 2026-03-10 - CVE-2026-29773 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29773

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), where the Kubewarden controller fails to properly enforce authorization boundaries when policies invoke deprecated host-callback APIs. The core issue stems from the controller's continued support for legacy API endpoints that bypass the intended namespace isolation model.

When users are granted permissions to create AdmissionPolicies within specific namespaces, the expectation is that these policies operate strictly within their namespace boundaries. However, the deprecated kubernetes/ingresses, kubernetes/namespaces, and kubernetes/services host-callback APIs do not properly enforce these restrictions, allowing a crafted policy to query resources across the cluster.

This is a read-only vulnerability—there is no write capability and no access to sensitive resources such as Secrets, ConfigMaps, or other resource types beyond Ingresses, Namespaces, and Services.

Root Cause

The root cause lies in the deprecated host-callback APIs that were not updated to respect the namespace isolation model introduced for namespaced AdmissionPolicies. These legacy APIs predate the current security model and retain cluster-wide read permissions, creating an authorization bypass when invoked from namespaced policies. The controller failed to restrict or remove these deprecated API endpoints, allowing them to be called by policies that should be confined to their respective namespaces.

Attack Vector

The attack vector is network-based and requires an authenticated attacker with elevated permissions to create AdmissionPolicy resources. This is not a default permission, meaning the attacker must have been explicitly granted AdmissionPolicy create permissions by a cluster administrator.

The attack flow involves:

1. An attacker with AdmissionPolicy create permissions deploys a malicious namespaced AdmissionPolicy
2. The policy is crafted to invoke the deprecated host-callback APIs (kubernetes/ingresses, kubernetes/namespaces, kubernetes/services)
3. When the policy is evaluated, it gains read access to cluster-wide resources of these three types
4. The attacker can exfiltrate information about Ingresses, Namespaces, and Services across the entire cluster

This attack requires low complexity as the deprecated APIs are straightforward to invoke once the attacker understands their existence. The vulnerability does not require user interaction.

Detection Methods for CVE-2026-29773

Indicators of Compromise

• Unexpected AdmissionPolicy resources created in namespaces, particularly those referencing host-callback functions
• Policy evaluation logs showing calls to deprecated APIs: kubernetes/ingresses, kubernetes/namespaces, or kubernetes/services
• Unusual audit log entries indicating cross-namespace resource queries from namespaced policies

Detection Strategies

• Review Kubernetes audit logs for AdmissionPolicy creation events, particularly from users who should not have cluster-wide visibility
• Monitor for policy evaluations that invoke the deprecated host-callback APIs
• Implement RBAC auditing to identify users with AdmissionPolicy create permissions who may attempt exploitation
• Use admission controller logging to track which policies are calling host-callback functions

Monitoring Recommendations

• Enable detailed Kubernetes audit logging for AdmissionPolicy and AdmissionPolicyGroup resources
• Configure alerts for policy creation events by non-administrative users
• Monitor Kubewarden controller logs for deprecated API invocations
• Implement network monitoring for unusual internal API traffic patterns within the cluster

How to Mitigate CVE-2026-29773

Immediate Actions Required

• Update the Kubewarden controller to the patched version immediately
• Audit existing AdmissionPolicies for any that may invoke the deprecated host-callback APIs
• Review and restrict RBAC permissions for AdmissionPolicy creation across the cluster
• Temporarily disable namespaced AdmissionPolicy creation until patches are applied

Patch Information

The Kubewarden project has addressed this vulnerability through a security patch. The fix is documented in GitHub Pull Request #1519 and implemented in commit 4e41b60. Organizations should update their Kubewarden controller deployment to incorporate this fix. For detailed information about the vulnerability and remediation steps, refer to the GitHub Security Advisory GHSA-6r7f-3fwq-hq74.

Workarounds

• Remove or restrict AdmissionPolicy create permissions from non-administrative users until patching is complete
• Implement OPA Gatekeeper or similar admission controllers to block policies that reference the deprecated APIs
• Use Kubernetes NetworkPolicies to limit policy engine communication paths where feasible
• Monitor and audit all namespaced AdmissionPolicy deployments for suspicious configurations