{"id":"CVE-2026-54523","title":"Kyverno is a policy engine designed for cloud native platform engineering teams","summary":"Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to …","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwe":["CWE-862"],"vendor":"kyverno","product":"github.com/kyverno/kyverno","affected":["github.com/kyverno/kyverno >= 1.18.0, <= 1.18.1"],"patched":["github.com/kyverno/kyverno 1.18.2"],"published":"2026-08-26","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54523","references":[{"url":"https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06","label":"security-advisories@github.com"},{"url":"https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae","label":"security-advisories@github.com"},{"url":"https://github.com/kyverno/kyverno/pull/16238","label":"security-advisories@github.com"},{"url":"https://github.com/kyverno/kyverno/releases/tag/v1.18.2","label":"security-advisories@github.com"},{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9","label":"security-advisories@github.com"},{"url":"https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df","label":"security-advisories@github.com"},{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-79gf-7frw-68m9"}],"tags":["nvd","ghsa","go"],"epss":0.00401,"epssPercentile":0.34042,"aliases":["GHSA-79gf-7frw-68m9"],"ecosystem":"go","ingestedAt":"2026-08-26T14:45:08.370Z","slug":"CVE-2026-54523","body":"## Overview\n\nKyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54523)\n\nAffected packages:\n\n- `github.com/kyverno/kyverno >= 1.18.0, <= 1.18.1`\n\nPatched in:\n\n- `github.com/kyverno/kyverno 1.18.2`\n\nSource: https://github.com/advisories/GHSA-79gf-7frw-68m9","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}