CVE-2026-54523
Description
A flaw was found in Kyverno, a policy engine for cloud-native platforms. A user with specific permissions to create policy objects in one area (namespace) can exploit a vulnerability where a namespace argument is not properly checked. This allows them to force the system's admission controller, which has broad access, to create resources like user role assignments (RoleBindings) in other restricted areas. This can lead to unauthorized changes and potentially elevate their access privileges within the system.
Statement
This Important vulnerability in Kyverno allows for privilege escalation due to improper validation of namespace arguments in NamespacedMutatingPolicy objects. However, Red Hat products, including Konflux components, are not affected by this flaw as the vulnerable code is not present in their deployments.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
An attacker could read sensitive data, either by reading the data directly from a data store that is not restricted, or by accessing insufficiently-protected, privileged functionality to read the data.
Integrity
Technical Impact: Modify Application Data; Modify Files or Directories
An attacker could modify sensitive data, either by writing the data directly to a data store that is not restricted, or by accessing insufficiently-protected, privileged functionality to write the data.
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
An attacker could gain privileges by modifying or reading critical data directly, or by accessing privileged functionality.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
An attacker could gain unauthorized access to resources on the system and excessively consume those resources, leading to a denial of service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
