CVE-2026-54523: Kyverno Privilege Escalation Vulnerability

CVE-2026-54523 Overview

CVE-2026-54523 is a missing authorization vulnerability [CWE-862] in Kyverno, a policy engine used by cloud native platform engineering teams. Versions 1.18.0 through 1.18.1 expose the generator library to matchConditions in the NamespacedMutatingPolicy Common Expression Language (CEL) compiler. This allows a namespace-scoped policy author to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The admission controller, which runs with cluster-wide privileges, then creates resources across namespace boundaries. Kyverno has fixed the issue in version 1.18.2.

Critical Impact
A tenant with permission to create NamespacedMutatingPolicy objects in one namespace can force the admission controller to write ConfigMaps, Secrets, NetworkPolicies, and RoleBindings into any other namespace, enabling privilege escalation across a shared cluster.

Affected Products

Kyverno 1.18.0
Kyverno 1.18.1
Kyverno SDK versions prior to commit 6573937

Discovery Timeline

2026-08-26 - CVE-2026-54523 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-54523

Vulnerability Analysis

Kyverno's NamespacedMutatingPolicy is intended to operate only within the namespace where the policy is created. The CEL compiler responsible for evaluating matchConditions in these policies binds the generator library without applying a namespace boundary check. As a result, policy authors can call generator.apply() with any target namespace string, and the call succeeds. Kyverno's admission controller holds cluster-wide permissions in order to mutate resources on behalf of any policy, so downstream resource creation runs with those elevated privileges. The vulnerability breaks the tenant isolation model that platform teams rely on when delegating NamespacedMutatingPolicy creation to workload owners.

Root Cause

Two enforcement gaps combine to produce the flaw. The validation logic in pkg/cel/policies/mpol/validate.go verifies that a policy compiles cleanly but does not confirm that generator targets stay within the policy's own namespace. The GenerateResources implementation in pkg/cel/libs/context.go accepts any namespace argument and does not reject cross-namespace targets. The fix introduces a namespacedImpl type that binds a policy's namespace at compile time and rejects any apply() call whose target namespace does not match.

Attack Vector

An attacker with rights to create NamespacedMutatingPolicy objects in a single namespace crafts a policy whose matchConditions invoke generator.apply("victim-namespace", resources). When any admission event triggers the policy, the Kyverno controller writes the supplied resources into the victim namespace using its cluster-scoped service account. Delivering a RoleBinding that grants cluster-admin to an attacker-controlled subject is sufficient to escalate from tenant to cluster administrator.

// Fix from cel/libs/generator/namespaced_impl.go — enforces namespace boundary
func (c *namespacedImpl) apply_generator_string_list(args ...ref.Val) ref.Val {
    if self, err := utils.GetArg[Context](args, 0); err != nil {
        return err
    } else if namespace, err := utils.GetArg[string](args, 1); err != nil {
        return err
    } else if namespace != c.namespace {
        return types.NewErr("cross-namespace generation denied: policy in %q cannot generate into %q", c.namespace, namespace)
    } else if dataList, err := utils.GetArg[[]*structpb.Struct](args, 2); err != nil {
        return err
    } else {
        var resources []map[string]any
        for _, data := range dataList {
            resources = append(resources, data.AsMap())
        }
        if err := self.GenerateResources(namespace, resources); err != nil {
            // ...
        }
    }
}
// Source: https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df

Detection Methods for CVE-2026-54523

Indicators of Compromise

NamespacedMutatingPolicy objects containing generator.apply() calls where the target namespace argument differs from the policy's own namespace.
Kubernetes audit log entries showing resource creation by the Kyverno admission controller service account in namespaces that do not host the triggering policy.
Unexpected RoleBinding, ClusterRoleBinding, or Secret objects appearing in tenant namespaces with ownerReferences or managed-by labels pointing to Kyverno.

Detection Strategies

Parse installed NamespacedMutatingPolicy CEL expressions and flag any string literal in generator.apply() that does not equal request.namespace or the policy's metadata.namespace.
Correlate Kubernetes API audit logs to detect writes performed by the Kyverno service account targeting namespaces outside the source policy's scope.
Run kubectl get namespacedmutatingpolicies -A -o yaml and inspect matchConditions and mutations fields for cross-namespace references.

Monitoring Recommendations

Ship Kubernetes audit logs to a centralized data lake and alert on resource creation events where the requesting user is the Kyverno controller and the target namespace differs from expected policy scope.
Baseline the Kyverno controller's normal resource-creation footprint per namespace and alert on deviations.
Monitor for new ClusterRoleBinding or RoleBinding objects that grant elevated verbs to service accounts in tenant namespaces.

How to Mitigate CVE-2026-54523

Immediate Actions Required

Upgrade Kyverno to version 1.18.2 or later on all clusters running 1.18.0 or 1.18.1.
Audit existing NamespacedMutatingPolicy objects for cross-namespace generator.apply() calls and remove any suspicious policies before upgrading.
Review recent Kubernetes audit logs for unauthorized resource creation performed by the Kyverno admission controller.

Patch Information

The fix is included in Kyverno v1.18.2. Details are published in the Kyverno Security Advisory GHSA-79gf-7frw-68m9, with implementation changes in Pull Request #16238 and the SDK namespace-boundary commit.

Workarounds

Restrict create, update, and patch permissions on NamespacedMutatingPolicy resources to trusted cluster administrators until the upgrade is complete.
Use a validating admission policy or OPA/Gatekeeper rule to reject NamespacedMutatingPolicy objects whose CEL expressions reference generator.apply with a namespace literal other than the policy's own namespace.
Reduce the Kyverno admission controller's cluster-scoped permissions where operationally feasible, limiting the blast radius of any generator misuse.

bash

# Upgrade Kyverno via Helm to the patched release
helm repo update
helm upgrade kyverno kyverno/kyverno \
  --namespace kyverno \
  --version 3.4.2 \
  --set image.tag=v1.18.2

# Audit existing NamespacedMutatingPolicy objects for cross-namespace generator calls
kubectl get namespacedmutatingpolicies -A -o json \
  | jq '.items[] | select(.spec.matchConditions[]?.expression | test("generator\\.apply"))'