A critical authorization bypass in the Kyverno policy engine allows authenticated namespace administrators to escalate privileges and access sensitive data across Kubernetes namespaces.

This vulnerability is an instance of CWE-863, where the ConfigMap context loader fails to validate the namespace field. An authenticated user with namespace-level permissions can leverage Kyverno's privileged service account to perform unauthorized reads of ConfigMaps in any namespace within the cluster.

The ability to access ConfigMaps across namespaces constitutes a complete RBAC bypass in multi-tenant Kubernetes environments. Given the CVSS score of 7.7, this flaw poses a high risk as it enables the exposure of sensitive configuration data, including API keys, tokens, or credentials stored in ConfigMaps, leading to potential lateral movement or full cluster compromise.

Immediate Action: Upgrade the Kyverno deployment to version 1.17.2 or later to apply the necessary namespace validation logic.

Proactive Monitoring: Audit Kubernetes audit logs for unusual access patterns to ConfigMaps initiated by the Kyverno service account or unexpected cross-namespace requests.

Compensating Controls: Implement strict Kubernetes Network Policies to restrict traffic to and from the Kyverno pod, and consider using admission controllers to enforce tighter RBAC restrictions on namespace administrators.

Public Exploit Available: Unknown

Given the potential for complete RBAC bypass in multi-tenant clusters, this vulnerability represents a significant security risk to cloud native infrastructure. Administrators must prioritize updating Kyverno to version 1.17.2 immediately to remediate this authorization flaw and prevent unauthorized access to sensitive cluster secrets.