8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-46342

CVE-2025-46342: Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Summary

Due to a missing error propagation in function GetNamespaceSelectorsFromNamespaceLister in pkg/utils/engine/labels.go it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations.

Details

As a policy engine Kyverno is a critical component ensuring the security of Kubernetes clusters by apply security-relevant policy rules in the Kubernetes admission control process.

We encountered a case where Kyverno did not apply policy rules which should have been applied. This happened in both the mutation and the validation phase of admission control. Effectively Kyverno handled the admission review requests as if those policy rules did not exist. Consequently, the Kube API request was accepted without applying security-relevant patches and validations.

As the root cause we identified a missing error propagation in function GetNamespaceSelectorsFromNamespaceLister in pkg/utils/engine/labels.go (src).

All affected policy rules use a namespace selector in their match resource filters like this:

match:
  all:
  - resources:
      namespaceSelector:
        matchExpressions:
        - key: label1
          operator: Exists

Such specification intents to apply rules only to resource objects which reside in a namespace whose labels match the given label expressions.

When Kyverno handles an admission webhook, function GetNamespaceSelectorsFromNamespaceLister in package github.com/kyverno/kyverno/pkg/utils/engine (src) is called to retrieve the labels of the request object's namespace. This function gets the namespace object from a . In case the namespace lister returns an error, does NOT propagate this error to its caller, but returns an empty label map, which is equivalent to a namespace without any labels.

Miggo Vulnerability Database

→

CVE-2025-46342

CVE-2025-46342:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/kyverno/kyverno	go	< 1.13.5	1.13.5
github.com/kyverno/kyverno	go	>= 1.14.0-alpha.1, < 1.14.0	1.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The core vulnerability, as described, lies in the GetNamespaceSelectorsFromNamespaceLister function in pkg/utils/engine/labels.go. This function failed to propagate errors from the namespace lister, instead returning an empty map of labels. This behavior is explicitly changed in the provided patch (commit 3ff923b7756e1681daf73849954bd88516589194), where the function signature is modified to return an error, and errors from the lister (or if the namespace object is nil) are propagated.

The other functions listed are callers of GetNamespaceSelectorsFromNamespaceLister. The patch modifies these caller functions to handle the newly propagated error. Before the patch, these functions would unknowingly consume the potentially incorrect (empty) namespace labels returned by the vulnerable GetNamespaceSelectorsFromNamespaceLister. This would lead to incorrect policy evaluation when namespace selectors were used, effectively causing the policy bypass described in the vulnerability. Therefore, these caller functions, in their pre-patch state, were vulnerable to the effects of the error suppression in GetNamespaceSelectorsFromNamespaceLister and are critical runtime indicators for when the vulnerability could be triggered or exploited. The analysis focuses on functions directly interacting with or containing the flawed logic as revealed by the patch.

While the prompt asks for all functions, the provided patch primarily focuses on the GetNamespaceSelectorsFromNamespaceLister and its direct callers. The vulnerability description also pinpoints GetNamespaceSelectorsFromNamespaceLister as the root cause. The other functions listed in the JSON are callers that were modified to handle the error propagation from GetNamespaceSelectorsFromNamespaceLister. In their pre-patch state, they would have been affected by the vulnerability because they would have received empty namespace labels when an error occurred, leading to incorrect policy application. Therefore, they are relevant as runtime indicators of where the vulnerability's effects would manifest.

However, to strictly adhere to the prompt's request for vulnerable functions (those containing the vulnerability or processing malicious input), GetNamespaceSelectorsFromNamespaceLister is the primary one. The others are vulnerable by proxy due to their reliance on the flawed function. For a more concise answer focusing on the direct vulnerability, only would be listed. But for a comprehensive view of runtime impact, the callers are also important.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-46342: Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Summary

Details

CVE-2025-46342:

8.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Basic Information

Basic Information

Technical Details

8.6

8.6

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

CVE-2025-46342: Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Summary

Details

Vulnerable functions

Correction Proposal

PoC

Impact

8.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-46342: Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Summary

Details

CVE-2025-46342:

8.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

8.6

8.6

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

CVE-2025-46342: Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Summary

Details

Vulnerable functions

Correction Proposal

PoC

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI