« Volver al listado

CVE-2025-46342

Estado: AnalizadaAlta (8.2)—

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:L indica acceso remoto con privilegios de usuario K8s (T1210). El bypass de políticas de seguridad permite escalada de privilegios (T1068) y manipulación de objetos Kubernetes (T1565.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningRestrict File and Directory Permissions

Tecnologías afectadas (1)

Kyverno — Kyverno

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-46342",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-46342",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-30T15:10:01.487557Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "kyverno",
          "product": "kyverno",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.13.5"
            },
            {
              "status": "affected",
              "version": ">= 1.14.0-alpha.1, < 1.14.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-30T15:16:02.440",
  "references": [
    {
      "url": "https://github.com/kyverno/kyverno/commit/3ff923b7756e1681daf73849954bd88516589194",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-jrr2-x33p-6hvc",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1287"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0."
    },
    {
      "lang": "es",
      "value": "Kyverno es un motor de políticas diseñado para equipos de ingeniería de plataformas nativas de la nube. En versiones anteriores a la 1.13.5 y la 1.14.0, podía ocurrir que las reglas de políticas que usaban selectores de espacios de nombres en sus declaraciones de coincidencia no se aplicaran por error durante el procesamiento de solicitudes de revisión de admisión debido a la falta de propagación de errores en la función `GetNamespaceSelectorsFromNamespaceLister` en `pkg/utils/engine/labels.go`. Como consecuencia, se omiten las mutaciones y validaciones críticas para la seguridad, lo que podría permitir que atacantes con acceso a la API de K8 realicen operaciones maliciosas. Este problema se ha corregido en las versiones 1.13.5 y 1.14.0."
    }
  ],
  "lastModified": "2026-06-17T09:26:16.163",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15691918-C220-4933-95D2-6BF2BFBBA7E3",
              "versionEndIncluding": "1.11.5"
            },
            {
              "criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C44B650-9836-486D-B929-58CD724E9792",
              "versionEndExcluding": "1.13.5",
              "versionStartIncluding": "1.12.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}