Unrated

Privilege Escalation in Kyverno NamespacedGeneratingPolicy

IdentifiersCVE-2026-54523CWE-862

CVE-2026-54523 is a critical cross-namespace privilege escalation vulnerability in Kyverno, the Kubernetes policy engine. The flaw affects Kyverno versions up to and including 1.18.1 and arises from missing authorization and namespace-boundary validation in the CEL-driven resource generation path used by NamespacedGeneratingPolicy. A tenant who is permitted to create a NamespacedGeneratingPolicy in their own namespace can supply an arbitrary namespace value to the generator.apply(namespace, resources) function, causing Kyverno’s background controller to generate resources in namespaces other than the policy’s namespace. The vulnerable behavior stems from the resource-generation path accepting the namespace argument without verifying that it matches the namespace of the policy. Because Kyverno’s background controller commonly operates with broad cluster-wide RBAC permissions, the issue creates a confused-deputy condition in which a low-privileged namespace-scoped user can induce the controller to perform privileged actions across namespace boundaries.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a namespace-scoped tenant to escalate privileges into arbitrary namespaces, including highly sensitive namespaces such as kube-system. An attacker can cause Kyverno’s background controller to create privileged Kubernetes resources on their behalf, including RoleBindings that grant administrative rights in the targeted namespace. Depending on the controller’s granted permissions, exploitation can also enable unauthorized creation or modification of other namespaced resources such as ConfigMaps, NetworkPolicies, and Ingresses. The practical impact is a break of tenant isolation and namespace trust boundaries, potentially leading to administrative control over workloads and policy-relevant resources in other namespaces.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, restrict RBAC so that only trusted principals, ideally cluster administrators or equivalently trusted operators, can create NamespacedGeneratingPolicy objects. Audit existing NamespacedGeneratingPolicy definitions for generator.apply usage that targets a namespace different from the policy namespace. Monitor sensitive namespaces for unexpected creation of Roles, RoleBindings, and other generated resources by Kyverno’s background controller. Where operationally feasible, reduce the background controller’s RBAC permissions to the minimum necessary.

Remediation

Patch, then assume compromise.

Upgrade Kyverno to version 1.18.2 or later. The fix enforces that the target namespace supplied to the generation function matches the namespace of the NamespacedGeneratingPolicy, preventing cross-namespace resource generation through this path. Administrators should also review existing NamespacedGeneratingPolicy objects for logic that attempts to target other namespaces and validate that only intended policies remain deployed after upgrade.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

security online infoNews

Jul 17, 2026

Kyverno Vulnerability CVE-2026-54523: PoC, Priv Esc

A critical privilege escalation vulnerability in Kyverno's NamespacedGeneratingPolicy feature that allows a namespace tenant to escalate privileges across namespaces, including to admin in kube-system, due to insufficient validation of the target namespace argument in generator.apply().

darkwebinformerNews

Jul 17, 2026

One Namespace String to kube-system: Cross-Namespace Privilege Escalation in Kyverno (CVE-2026-54523)

A critical cross-namespace privilege escalation vulnerability in Kyverno caused by missing namespace authorization in NamespacedGeneratingPolicy generation, allowing a low-privileged namespace-scoped user to leverage Kyverno's background controller to create resources such as RoleBindings in arbitrary namespaces and escalate privileges cluster-wide.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5