| id: GO-2026-6296 | |
| modules: | |
| - module: github.com/kyverno/kyverno | |
| versions: | |
| - introduced: 1.18.0 | |
| - fixed: 1.18.2 | |
| vulnerable_at: 1.18.2-rc.1 | |
| summary: |- | |
| Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument | |
| unvalidated -- background controller creates RoleBindings in any namespace | |
| including kube-system in github.com/kyverno/kyverno | |
| cves: | |
| - CVE-2026-54523 | |
| ghsas: | |
| - GHSA-79gf-7frw-68m9 | |
| references: | |
| - advisory: https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9 | |
| - fix: https://github.com/kyverno/kyverno/commit/0919553c0ea1904f8d891280c92018da97946a06 | |
| - fix: https://github.com/kyverno/kyverno/commit/5164bcdeda5b57678bc2d7a03ecc2cbb02982dae | |
| - fix: https://github.com/kyverno/kyverno/pull/16238 | |
| - web: https://github.com/kyverno/kyverno/releases/tag/v1.18.2 | |
| - web: https://github.com/kyverno/sdk/commit/6573937441443e1ba5af9fbb28d5c0f20297f9df | |
| source: | |
| id: GHSA-79gf-7frw-68m9 | |
| created: 2026-08-27T15:18:40.193735-04:00 | |
| review_status: UNREVIEWED |