CVE-2026-54523 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
A namespace-scoped user can exploit unvalidated namespace arguments to force cluster-wide controllers to create resources in arbitrary namespaces, enabling privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54523?
CVE-2026-54523 is a critical missing authorization vulnerability in kyverno, published on 26 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.
Weakness: CWE-862
Which versions are affected by CVE-2026-54523?
4 open source packages ship an affected version, including github.com/kyverno/kyverno and kyverno.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kyverno/kyverno Go | From 1.18.0 | 1.18.2 |
github.com/kyverno/kyverno Go | From 1.18.0 | 1.18.2 |
github.com/kyverno/kyverno Go | From 1.18.0 | 1.18.2 |
kyverno Bitnami | From 1.18.0 | 1.18.2 |
How do I fix CVE-2026-54523?
Upgrade github.com/kyverno/kyverno to 1.18.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54523 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54523 exists.
Sources
Also known as BIT-kyverno-2026-54523, GHSA-79gf-7frw-68m9, GO-2026-6296, MINI-7cq4-9crw-622g, MINI-qcvp-x689-gm2g, MINI-rprx-gwrq-8544 and 1 more.