🔥 CyberForge CVE of the Day #097 🚨 Kyverno in Kubernetes — five controller and namespace-boundary flaws CVE-2026-122311 · CVE-2026-122313 · CVE-2026-122310 · CVE-2026-122302 · CVE-2026-122304 A namespace policy author must not inherit the controller’s wider rights. Five different routes cross that boundary; no five-step chain is demonstrated. Shared fix: Kyverno 1.19.2, through a complete supported upgrade. ⚠️ Prioritise affected tenant-delegated installations and sensitive controller rights. 🎯 The quick hit: What is happening? A permitted policy author can make a Kyverno controller perform API work beyond the intended author/namespace boundary. Who checks? Platform/SOC owners: exact controller builds/images, policy types, tenant rights, evaluation conditions and effective controller RBAC. Why care? Described effects include cross-namespace access, permission/configuration changes and privileged admission paths, bounded by the actual route and rights. Start with: installation/delegation → preserve policies/RBAC/audit → constrain unjustified rights → complete the fixed upgrade. Follow the evidence: author/policy version → evaluation → controller → target → supported result. Escalate: credible unauthorised cross-namespace, RBAC or webhook changes. An affected version or controller username alone is insufficient. Watch the gaps: ranges, missing bodies, normalised paths, asynchronous calls and partial upgrades. 🔑 Key details: ⭐ Severity: four maintainer advisories are Critical. For 122302, the maintainer says High, no numeric CVSS; VulnCheck’s CNA says Critical. 📊 122311 / 122313 / 122310 / 122304: CNA CVSS v3.1 Base 9.9 and v4.0 Base 9.4. Their maintainer advisories separately publish 9.9 v3.1. 🧮 Their exact v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` 🧮 Their exact CNA v4.0 vector: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H` 📊 122302: CNA v3.1 Base 9.8 / v4.0 Base 9.3. 🧮 122302 v3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` 🧮 122302 v4.0: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` 🔓 Important conflict: 122302’s PR:N differs from its own CNA prose and original static report, which require namespace-admin/policy-authoring access. Preserve the vector; do not claim unauthenticated takeover. 🧠 Primary CNA CWEs: 122311 CWE-22; 122313/122302 CWE-269; 122310 CWE-436; 122304 CWE-863. 🎯 Product: Kyverno in Kubernetes; the core Kubernetes version cannot establish this correction. 🛡️ Fix: 1.19.2; chart 3.9.2, appVersion v1.19.2. Distinct versions; image-only replacement is insufficient. 🚨 Activity / PoC: public reproduction material for four cases; 122302 is static-only. Laboratory clusters, published PoC/source and constructor tests are different evidence levels. Field exploitation was not verified in the reviewed primary material; no exploit run here. 📋 KEV: all five are exact-ID non-matches in catalog 2026.11.04, released 2026-11-04T20:00:05.774Z, 1,768 entries. Non-match is not safety evidence. No CISA ADP/SSVC assessment was present in the captured CVE records. 📉 FIRST: all rows dated 2026-11-05. Probability / percentile: 122311 0.448% / 39.08th; 122313 0.311% / 24.079th; 122310 0.357% / 29.567th; 122302 0.284% / 21.078th; 122304 0.392% / 33.522nd. Percentile is ranking, not exploit probability. NVD: Undergoing Analysis for all five. Its v3.1 Primary and v4.0 Secondary metrics name disclosure@vulncheck.com, not an independent NIST assessment. 🏷️ Credits: zer0d4y5; manus-use / zx (Jace); Artem Cherezov / cherez0ff; Trenyx; euriconicacio; thevilledev also in cleanup CNA. 🧬 What actually went wrong? 122311: CEL resource arguments can redirect client-resolved API scope beyond the namespace. The researcher’s lab also records default-RBAC Secret denial; reach is not universal Secret access. 122313: a NamespacedMutatingPolicy CEL target can name another tenant’s object; the background controller lacks expected confinement. Trigger namespace does not constrain target namespace. 122310: URL validation and execution interpret the target differently. The described takeover uses webhook authority and a later privileged admission, not unrestricted direct RBAC writing. 122302: generation checks controller rights instead of author rights. Original evidence is static-only, not an unauthenticated exploit demonstration. 122304: cleanup context lacks the policy namespace that activates confinement. A namespaced delete target does not prove safe context operations. Patch evidence: 1.19.2 links all five GHSAs. Selected production changes add path validation, consistent canonicalisation and target-scope/identity guards; merged PR descriptions cover cleanup and separate author/controller checks. Static review, not build/runtime proof. Not established: host escape, OS commands, every Secret readable, every tenant compromised or a five-flaw chain. Rights/evaluation bound impact. 📦 Which deployments belong in scope? 🔴 CNA ranges, lower inclusive / upper exclusive: • CVE-2026-122311: Kyverno >=1.16.0, <1.19.2; relevant namespaced CEL policy/resource path, with authoring and evaluation rights. • CVE-2026-122313: >=1.17.0, <1.19.2; NamespacedMutatingPolicy, mutate-existing/CEL target and relevant trigger. • CVE-2026-122310: >=1.19.1, <1.19.2; namespaced Policy with context.apiCall and evaluation opportunity. • CVE-2026-122302: <1.19.2, raw lower sentinel 0; generate-rule policy authoring and relevant background-controller rights. • CVE-2026-122304: >=1.17.0, <1.19.2; namespaced CleanupPolicy context and cleanup-controller rights. 🟢 Published correction: 1.19.2, applied through the supported installation method and verified on every relevant serving replica/supporting resource. Source differences: 122311/122313 GHSA affected fields stop at <=1.19.0, while CNA includes 1.19.1. 122310’s GHSA field is <=v1.19.1, broader than its CNA lower bound. 122302’s GHSA names main @21168fdf, not a full release range. Preserve these fields; do not infer safety from a narrower historical table. Inventory: kind/group, author/trigger rights, controller identity/roles and actual target scope. Custom grants widen impact; desired tags do not prove running correction. 🕰️ Exposure window and timeline: 13th–17th October 2026: selected correction PRs merged into the release branch. 20th October: v1.19.2 release published 23:50:19Z. 21st October: five maintainer advisories published; CNA datePublic also says October 21st. 4th November: selected CVEs reserved. 5th November: CNA records published; this is distinct from the earlier release/advisory dates. 6th November: this research snapshot. Historical “current/unfixed” wording in an original report does not override its patched field and the later fixed-release association. Hunt window: evidenced affected installation/delegation → verified corrected running/supporting state. Today’s grants cannot reconstruct former author/controller rights. Record clocks, retention, recreation, rollback and missing policies. 🗺️ MITRE ATT&CK: Conditional CyberForge capability mapping, not an observed intrusion. TA0004 → T1068 Exploitation for Privilege Escalation. Case basis: permitted author → flawed delegation → greater controller-mediated authority. Containers supported. Defender pivot: affected code, actual author rights, controller operation and unauthorised result. Reference: v1.6, modified 24th October 2025. https://attack.mitre.org/techniques/T1068/ T1098.006 Additional Container Cluster Roles. Relevant to supported Role/RoleBinding grants, particularly 122313; privilege escalation/persistence context is conditional. Defender pivot: subjects/rules, target identity, authorisation and later use; persistence needs evidence. Reference: v1.0, modified 15th April 2025. https://attack.mitre.org/techniques/T1098/006/ Limit: T1611 Escape to Host reviewed and rejected: Kubernetes API authority does not establish node-root access. No actor or complete initial-access/exfiltration chain inferred. 🧭 SOC investigation trail: Objective: establish whether a tenant policy caused an unauthorised controller operation. Proposed checks, not findings. Scope: approved installation/UTC interval, authority, clocks and source health. Preserve policy/RBAC/audit evidence before disruptive change where practicable. C01 — Applicability and delegated entry Action / location: reconcile builds/running image IDs, ServiceAccounts, aggregated roles, API discovery and tenant create/update rights against each range. Signal / correlate: same installation, affected code, policy type, author/namespace and evaluation opportunity agree. Benign causes / limits: stale tags, inactive rollout, absent CRDs, newer docs, custom builds or changed grants. Escalate: affected/unresolved delegation to change owner; suspicious activity to SOC. Version alone is not compromise. No cluster queried. C02 — Policy submission and evaluation Action / location: preserve policy UID/version/generation and existing audit/controller/GitOps history; inspect relevant fields only where retained. Signal / correlate: input/change, author, evaluation and controller agree; keep source/record IDs. Benign causes / limits: approved maintenance, dynamic names/conversion; Metadata audit lacks bodies, GitOps identity needs an author trail. Escalate: credible input plus processing to triage; missing body/history to a gap. No proof policy/trigger submitted. C03 — Controller action and target outcome Action / location: join processing to independent API/object history by controller identity, group/resource, namespace, name/UID and time. Signal / correlate: action exceeded intended scope and an unauthorised result is supported. Benign causes / limits: authorised platform policies, retries/reconciliation and skew. Normalised requestURI may lack traversal; separate calls have separate audit IDs. Escalate: corroborated outcome to IR; ambiguity to owners; missing joins unresolved. No detector/synthetic event run. C04 — Permission and admission changes Action / location: compare trusted binding subjects, role rules/aggregation, webhooks, exceptions and relevant config/network state with approved work. Signal / correlate: unapproved change linked to policy/controller/interval and target identity; distinguish edits from replacement. Benign causes / limits: GitOps grants, webhook maintenance and normal exceptions; familiar names do not prove trusted contents. Escalate: unexplained RBAC/admission changes to platform/identity/IR. Preserve before reverting; no blanket deletion. C05 — Conditional data and follow-on Action / location: if supported, scope accessible data, affected identities and later use in protected audit/target records with owners. Signal / correlate: operation, rights/content and consequence agree; preserve the extra privileged admission for 122310’s takeover path. Benign causes / limits: legitimate integrations/reads and missing bodies; Secret access and all-object theft are not universal. Escalate: widen tenant/data/credential response on evidence. Keep tokens, kubeconfigs, bodies and private endpoints private. C06 — Full correction and historical disposition Action / location: verify fixed serving admission/background/cleanup images, release/CRD/RBAC/webhook state, benign policy behaviour and service health. Signal / correlate: replicas/supporting install match 1.19.2 or later confirmed correction; old rollout/rollback accounted for. Limits: image-only edits, stale replicas/custom grants and failed reconciliation; patching cannot undo an earlier permission/webhook change. Escalate: failed acceptance to change owner; activity to IR; missing history to an owned gap. No upgrade/recovery performed. The analyst handover: Record cluster/owner → UTC window → author/policy/trigger → controller → target → observation/source IDs → alternatives/gaps → next action/owner. Separate applicability, reach, suspicion, corroborated outcome and insufficient telemetry. A no-match needs examined sources, fields/bodies, filters and collection health. All six image boxes are empty; local installation, activity, correction and recovery are unassessed. 🔎 Indicators and observable behaviour: No verified malicious IP/domain/hash or universal signature supplied. Code commits and lab fixture names are not field IOCs. Leads: policy resource paths, CEL targets, API/generate/cleanup context plus an unexpected controller action. Legitimate automation uses the same fields. Review unauthorised RoleBinding/role, webhook, exception, NetworkPolicy or ConfigMap changes only where that route’s controller rights make them relevant. Keep five separate applicability rows; do not call every effect universal. Visibility: Metadata audit lacks bodies; normalised URIs may hide original input. String hits are candidates, not success. 🧰 Optional CVE checks: Documentation/Bash syntax checked only; not run against Kubernetes. Use approved credentials, supported client/server and explicit contexts. No test policy, scan or impersonation. Check A — Inventory one serving installation On an approved workstation, inspect the owner-selected installation’s running Pods: ```bash ( IFS= read -r -p 'Approved cluster context: ' cve097_cluster_context IFS= read -r -p 'Kyverno namespace: ' cve097_install_namespace if [ -z "$cve097_cluster_context" ] || [ -z "$cve097_install_namespace" ]; then printf '%s\n' 'Explicit context and namespace required.' >&2 exit 2 fi kubectl --context "$cve097_cluster_context" --namespace "$cve097_install_namespace" \ get pods -o 'custom-columns=NAME:.metadata.name,SA:.spec.serviceAccountName,IMAGES:.spec.containers[*].image,IMAGE_IDS:.status.containerStatuses[*].imageID' ) ``` Interpret / correlate: match replicas/running IDs to trusted provenance, desired deployments and release/CRD/RBAC. Missing status, errors or wrong/empty namespace are gaps; a tag/CLI is not proof. Reads may audit; keep outputs private. Check B — Review one author’s policy-create rights Use the approved author’s existing context; an administrator context answers for the administrator: ```bash ( IFS= read -r -p 'Approved author context: ' cve097_author_context IFS= read -r -p 'Author namespace: ' cve097_author_namespace if [ -z "$cve097_author_context" ] || [ -z "$cve097_author_namespace" ]; then printf '%s\n' 'Explicit author context and namespace required.' >&2 exit 2 fi for cve097_resource in http://policies.kyverno.io \ http://namespacedvalidatingpolicies.policies.kyverno.io \ http://namespacedmutatingpolicies.policies.kyverno.io http://cleanuppolicies.kyverno.io do printf 'Policy resource: %s\n' "$cve097_resource" kubectl --context "$cve097_author_context" --namespace "$cve097_author_namespace" \ auth can-i create "$cve097_resource" cve097_review_status=$? printf 'Review exit status: %s\n' "$cve097_review_status" done ) ``` Interpret / limit: Yes is current direct create permission, not success. No cannot clear past/update rights, stored policies or controller effects. Check discovery/errors. Access reviews are non-persistent, may audit, and create no policy/RBAC grant. Not executed. 🩹 Remediation and verification: 1⃣ — Scope delegation. Establish controller builds, policy kinds, author/trigger rights and aggregated roles. A tenant’s direct target denial does not eliminate controller-mediated reach. 2⃣ — Preserve history. Retain available policy/RBAC/admission/audit/controller records before change; document missing bodies, clocks, retention and urgent exceptions. Protect sensitive content. 3⃣ — Complete the upgrade. Use Kyverno 1.19.2, chart 3.9.2 / appVersion v1.19.2, or later vendor-confirmed correction through the supported method. Supporting resources change; one image-tag edit is insufficient. No installer executed here. 4⃣ — Verify serving/supporting state. Reconcile controller image IDs, CRDs/RBAC/webhooks, old replicas/rollback and benign service health. Custom builds need provenance; an install command is not full acceptance. 5⃣ — Resolve consequences. Restore trusted permissions/admission state and scope data/credential exposure on evidence. A patch does not undo mutations or recover missing history. Temporary controls: owner-approved authoring/role restrictions may reduce opportunity; stored policies/evaluation still matter. Networking does not repair delegation. No equivalent workaround certified. 🧾 Evidence separation: Vendor / official: five CNA records, exact GHSA references, patched fields/release/chart and dated KEV/FIRST. Researcher: distinct lab/PoC/constructor claims and Trenyx static-only analysis; not our tests or field findings. CyberForge: priority, SOC checks, conditional ATT&CK and acceptance questions. Not established: local reach/results, data exposure, detector coverage, correction or recovery. GHSA cve_id remains null; CNA references bridge it. No bundle score or manufactured five-step chain. 🔥 CyberForge verdict: Five separate flaws share one question: did a permitted author make a more privileged controller act beyond the intended boundary? Priority: scope affected tenant-delegated installations and complete the shared fix. Preserve range differences and 122302’s severity/privilege conflict; no unauthenticated headline. Defender order: author/installed scope → preserve/correlate → controller/target outcome → complete correction → verify → resolve history. The decision that matters: controller RBAC approval does not prove the author was entitled to cause the operation. Follow author, controller and target together. > Correct the controller, verify the delegation boundary, and let evidence decide the incident. 🔗 Sources and further reading: Fixed release: https://github.com/kyverno/kyverno/releases/tag/v1.19.2 122311: https://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2 122313: https://github.com/kyverno/kyverno/security/advisories/GHSA-f96w-622v-rqpq 122310: https://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4 122302: https://github.com/kyverno/kyverno/security/advisories/GHSA-q62c-r9v2-cf64 122304: https://github.com/kyverno/kyverno/security/advisories/GHSA-p58h-r4j3-h5vx Upgrade: https://kyverno.io/docs/installation/upgrading/ Kubernetes auditing: https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ Audit Event fields: https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ Inventory: https://kubernetes.io/docs/reference/kubectl/generated/kubectl_get/ Access review: https://kubernetes.io/docs/reference/kubectl/generated/kubectl_auth/kubectl_auth_can-i/ KEV: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json FIRST: https://api.first.org/data/v1/epss?cve=CVE-2026-122311,CVE-2026-122313,CVE-2026-122310,CVE-2026-122302,CVE-2026-122304 #CyberSecurity #CVE #BlueTeam #ThreatHunting #SOC #CyberForge #Kyverno #Kubernetes #RBAC
