CVE-2025-46342

Katalog CVE

CVSS 8.2 · High EPSS 0,75%

Kerentanan Improper Validation of Specified Type of Input pada kyverno. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0.

Rincian

Terbit di NVD

30 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1287: Improper Validation of Specified Type of Input

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kyverno/kyverno/security/advisories/GHSA-jrr2-x33p-6hvc exploit · advisory vendor
• https://github.com/kyverno/kyverno/commit/3ff923b7756e1681daf73849954bd88516589194 patch