CVE-2025-46342

HIGH EPSS 45.1%
Published Apr 30, 20251y ago · Modified Jun 17, 20262w ago
8.2 CVSS 3.1
High
Find Similar
Published Apr 30, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0.

CVSS Details

Base Score
8.2
Exploitability
1.8
Impact
5.8
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality None
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
45.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-1287

Affected Products 2

VendorProductVersionRange
kyvernokyverno* ≤1.11.5
kyvernokyverno*≥1.12.0  –  <1.13.5

References 2

  • github.com https://github.com/kyverno/kyverno/commit/3ff923b7756e1681daf73849954bd88516589194
    Patch
  • github.com https://github.com/kyverno/kyverno/security/advisories/GHSA-jrr2-x33p-6hvc
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/kyverno/kyverno/commit/3ff923b7756e1681daf73849954bd88516589194
    Patch