CVE-2026-54523 kyverno CVE debrief

Who should care

Cloud-native platform engineering teams using Kyverno for policy management should assess exposure and prioritize upgrading to version 1.18.2 or later. Teams should verify namespace-scoped policies, restrict permissions for creating NamespacedMutatingPolicy objects, and monitor for suspicious activity. This vulnerability allows unauthorized modification and potential privilege escalation, making it critical for teams to take immediate action.

Why it matters

CVE-2026-54523 is a critical vulnerability in Kyverno that allows unauthorized modification and potential privilege escalation. Engineering teams using Kyverno should assess exposure, verify namespace-scoped policies, restrict permissions, and prioritize upgrading to version 1.18.2 or later.

• Potential unauthorized modification of resources in arbitrary namespaces
• Possible privilege escalation through exploitation of the admission controller
• Need for verification of namespace-scoped policies and restricted permissions
• Priority for upgrading to patched version 1.18.2 or later

Technical summary

The NamespacedMutatingPolicy CEL compiler in Kyverno exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. This flaw enables unauthorized modification and potential privilege escalation. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, Role

Defensive priority

High priority for upgrading to version 1.18.2 or later, verifying namespace-scoped policies, and restricting permissions for creating NamespacedMutatingPolicy objects.

Recommended defensive actions

• Upgrade to Kyverno version 1.18.2 or later
• Verify and restrict permissions for creating NamespacedMutatingPolicy objects
• Monitor for suspicious activity in namespace-scoped policies
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in Kyverno versions 1.18.0 to 1.18.1. The issue is fixed in version 1.18.2. Users can create NamespacedMutatingPolicy objects to exploit the vulnerability, which allows unauthorized modification and potential privilege escalation. Engineering teams should verify namespace-scoped policies, restrict permissions, and prioritize upgrading to version 1.18.2 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.