Kubewarden AdmissionPolicyGroup Context-Aware Resource Information Leak Vulnerability

A vulnerability in the Kubewarden controller's AdmissionPolicyGroup resource allows non-admin users to create context-aware policies that can query the Kubernetes API and access sensitive information, such as Secrets, beyond their permissions. This issue arises because the AdmissionPolicyGroup, introduced in version 1.17.0, can be managed by users in their own namespaces. The vulnerability depends on the privileges of the ServiceAccount used by the Policy Server, with the default Helm chart granting broad access to cluster resources. The issue is present in Kubewarden versions 1.17.0 and later, and has been patched in version 1.21.0.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive Kubernetes resources, such as Secrets, by allowing context-aware policies to query the API using elevated permissions.

Reproduction

To reproduce this vulnerability, create an AdmissionPolicyGroup resource in a namespace owned by a non-admin user. Include a context-aware policy that has access to Kubernetes Secrets. Once applied, the policy can retrieve Secrets that are not accessible to the user, exploiting the elevated permissions of the ServiceAccount used by the Policy Server.

Remediation

Upgrade to Kubewarden version 1.21.0 or later, which removes the ability to define context-aware policies in AdmissionPolicyGroup resources. For clusters running Kubewarden version 1.17.0 prior to 1.21.0, a ClusterAdmissionPolicy can be applied to deny the creation of AdmissionPolicyGroup resources with context-aware definitions.