Kyverno CVE-2026-54523

The attacker must be an authenticated Kubernetes user (PR:L) holding 'create' permission on namespacedmutatingpolicies.policies.kyverno.io within at least one namespace, and the cluster must run Kyverno 1.18.0 or 1.18.1 with the NamespacedMutatingPolicy (nmpol) feature reachable. The exploit specifically requires embedding generator.apply("<target-namespace>", [...]) inside a policy matchConditions expression; the target namespace is attacker-chosen and unvalidated. Limiting factors: exploitation is gated by tenant RBAC (a user with no rights to create these policy objects cannot exploit it), it only works on the narrow 1.18.0-1.18.1 version band (fixed in 1.18.2), and it depends on the admission controller running with its default cluster-wide privileges. No end-user interaction is needed, and the trigger fires when a matching admission request is processed.

This is a genuine high-priority issue for multi-tenant clusters, not merely a high-CVSS paper cut. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base 9.6) is well justified: the attack is over the Kubernetes API (AV:N), low complexity (AC:L), needs only tenant-level create rights on namespacedmutatingpolicies (PR:L), no user interaction, and crosses a trust boundary (S:C) by abusing the controller's cluster privileges to reach other namespaces with high confidentiality and integrity impact. Availability is untouched (A:N), consistent with the fact that the primitive creates/overwrites resources rather than destroying the cluster. A concrete PoC in the advisory raises real-world likelihood; however no EPSS score is provided, there is no CISA KEV listing, and no evidence of active exploitation, so exploitation risk is currently demonstrated-but-not-observed in the wild. The main limiter is prerequisite RBAC - the attacker must already be a legitimate tenant able to create these policy objects - so exposure is confined to clusters running the narrow vulnerable version band (1.18.0-1.18.1) with the nmpol feature reachable by tenants. One data nuance: the CVE description says 'from 1.18.0 until 1.18.2' while the vendor advisory scopes the practical vector to 1.18.0-1.18.1 (NamespacedGeneratingPolicy is not a functional vector in 1.18.1); treat 1.18.2 as the fixed release.

A tenant with create rights on namespacedmutatingpolicies in tenant-ns submits a NamespacedMutatingPolicy whose matchConditions contain generator.apply("kube-system", [ ...RoleBinding/ConfigMap... ]); when any matching admission request is evaluated, the cluster-privileged admission controller creates the attacker-specified resources in kube-system. By generating a RoleBinding that grants their identity elevated permissions, the tenant escalates from a single namespace to cluster-wide control. A working proof-of-concept manifest is published in the GitHub advisory, lowering the bar to reproduce.