CVE-2026-54523 (CVSS 9.6): Public PoC Exploit Enables Kyverno Privilege Escalation to Admin in Any Namespace
Do Son 
TL;DR
A critical Kyverno vulnerability, CVE-2026-54523 (CVSS 9.6), has been publicly disclosed with full technical details and proof-of-concept exploit code. The flaw lets a namespace tenant escalate to admin in any namespace, including kube-system. Kyverno fixed it in version 1.18.2.
Why It Matters
Kyverno is a popular Kubernetes-native policy engine used for security and governance. Many platform teams grant tenants limited policy-creation rights inside their own namespace. This Kyverno vulnerability turns that limited access into cluster-wide privilege escalation. Because both the advisory and the PoC are now public, the barrier to abuse is low.
How the Attack Works
The problem lies in the NamespacedGeneratingPolicy feature. Its CEL generator.apply() function takes a target namespace argument. However, Kyverno never checks that this argument matches the policy’s own namespace. As a result, a tenant can point the generator at any namespace.
Kyverno‘s background controller then acts on that instruction. By default, it holds cluster-wide privileges to create RoleBindings, Roles, ConfigMaps, and NetworkPolicies. Consequently, a tenant can direct it to create a RoleBinding that grants admin rights elsewhere. This report omits the runnable exploit steps.
Affected Versions
The flaw affects Kyverno versions 1.18.1 and earlier. The vendor confirmed the issue on the main branch as of May 20, 2026.
Exploitation Status
Public proof-of-concept exploit code exists, and the vendor advisory includes it. No in-the-wild exploitation has been confirmed at this time.
Patch and Mitigation
Kyverno resolved the issue in release v1.18.2, so administrators should upgrade now. Until then, review who holds create rights on NamespacedGeneratingPolicy and revoke unnecessary access.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
