Kyverno NamespacedMutatingPolicy Flaw Lets Tenants Trigger Cluster-Wide Resource Creation via CEL generator.apply() (CVE-2026-54523)

A newly clarified GitHub Security Advisory (GHSA-79gf-7frw-68m9) details CVE-2026-54523, a critical flaw (CVSS 9.6) in Kyverno affecting v1.18.0 and v1.18.1. According to the advisory, a namespace-scoped tenant who can create a NamespacedMutatingPolicy in their own namespace can invoke the CEL function generator.apply(namespace, resources) inside a matchConditions expression, passing an arbitrary target namespace string. Because the underlying GenerateResources function does not validate that argument, the admission controller — which holds cluster-wide RBAC — creates the specified resources in whatever namespace the tenant names, including kube-system. The advisory notes that NamespacedGeneratingPolicy is not exploitable on v1.18.1 due to incomplete webhook/background wiring, so the reachable path is specifically via NamespacedMutatingPolicy. A public proof-of-concept is available in the advisory.

Why It Matters

Kyverno is a widely deployed Kubernetes policy engine, and its admission controller commonly runs with broad, cluster-scoped privileges by design. Per the advisory, any installation that grants non-admin users permission to create NamespacedMutatingPolicy objects is affected. The reported impact includes injecting configuration into protected namespaces, disrupting networking via NetworkPolicy creation, and privilege escalation through RoleBinding creation in namespaces the tenant does not otherwise control — effectively letting a namespace-scoped user leverage the admission controller as a confused deputy.

What Defenders Should Do Now

• Inventory who can create or modify NamespacedMutatingPolicy resources in your clusters, and treat that permission as cluster-admin-adjacent until patched.
• Check your Kyverno version against the fixed release referenced in the advisory and plan an upgrade for any cluster on v1.18.0/v1.18.1.
• Hunt for unexpected admission-controller-authored writes (ConfigMaps, Secrets, NetworkPolicies, RoleBindings) landing in sensitive namespaces such as kube-system or default, particularly ones not tied to a legitimate cluster-admin action.
• Review existing NamespacedMutatingPolicy objects for CEL matchConditions expressions that call generator.apply(), especially with a hardcoded or attacker-controllable namespace argument.
• As a stopgap, restrict RBAC on namespacedmutatingpolicies.policies.kyverno.io creation to trusted, cluster-privileged users only.

This is developing intel based on a single, recently updated advisory; details on the exact patched version and full exploitation scope may evolve. For the complete technical writeup, timeline, and proof-of-concept, see the original advisory: GHSA-79gf-7frw-68m9.