CVE-2026-54523: Kyverno CEL Generator Bypasses Namespace Isolation

Overview

A critical vulnerability has been disclosed in Kyverno, the CEL and admission-control policy engine widely used to enforce guardrails on Kubernetes clusters. Tracked as CVE-2026-54523 (CVSS 9.6), the flaw allows a tenant who can only create policies inside their own namespace to force Kyverno's background controller to generate resources — including RoleBindings — in any namespace on the cluster, including kube-system.

In multi-tenant clusters where namespace-scoped policy authoring is delegated to individual teams, this collapses the isolation boundary Kyverno is meant to enforce.

Technical Details

How It Works

Kyverno's NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions. That library provides a generator.apply(namespace, resources) function intended to create resources scoped to the policy's own namespace — but the compiler does not validate the namespace argument passed to it.

A user who can only create a NamespacedMutatingPolicy in their own namespace can write a matchConditions expression that calls generator.apply() with an arbitrary target namespace string. Kyverno's background controller then dutifully creates the specified resources — including RoleBindings — in that namespace, with no check that the calling policy is actually scoped there.

Because kube-system is a valid target string like any other, a low-privileged tenant can direct the controller to create a RoleBinding inside kube-system, opening a path to cluster-admin-level privilege escalation.

Impact

• Namespace isolation bypass — the core guarantee of namespace-scoped policies (a tenant can only affect their own namespace) does not hold
• Privilege escalation — RoleBindings created in kube-system or other privileged namespaces can grant a low-privileged tenant elevated cluster permissions
• Multi-tenant blast radius — any cluster that delegates NamespacedMutatingPolicy authoring to individual teams or customers is exposed, not just clusters with malicious insiders — a compromised low-privilege service account is enough

No public proof-of-concept was available at time of disclosure, and there are no reports of in-the-wild exploitation.

Remediation

• Upgrade to Kyverno v1.18.2 or later, which validates the namespace argument passed to generator.apply() against the policy's own namespace
• Until patched, audit existing NamespacedMutatingPolicy and NamespacedGeneratingPolicy objects for matchConditions that reference generator.apply with a non-self namespace
• Restrict who can create namespace-scoped policies via RBAC if immediate patching isn't possible
• Review RoleBindings in kube-system and other sensitive namespaces for unexpected entries created by the background controller

References

• NVD — CVE-2026-54523
• GitLab Advisory Database — CVE-2026-54523