Kyverno Namespace Selector Bypass Vulnerability in Admission Review Processing

A vulnerability exists in Kyverno versions prior to 1.13.5 and 1.14.0, where policy rules utilizing namespace selectors in their match statements may not be applied during admission review. This issue arises from a lack of proper error handling in the function 'GetNamespaceSelectorsFromNamespaceLister' within 'pkg/utils/engine/labels.go'. As a result, security-critical mutations and validations can be bypassed, potentially allowing attackers with Kubernetes API access to execute malicious actions.

Impact

This vulnerability can lead to a bypass of Kyverno policies, allowing unauthorized actions on resources that should be governed by those policies. This is particularly concerning for security-critical policies that manage mutations and validations during the Kubernetes admission process.

Remediation

Users can upgrade to Kyverno versions 1.13.5 or 1.14.0, where this vulnerability has been patched.