Kyverno up to 1.13.4/1.13.x labels.go GetNamespaceSelectorsFromNamespaceLister improper validation of specified type of input

Summaryinfo

A vulnerability labeled as critical has been found in Kyverno up to 1.13.4/1.13.x. Impacted is the function GetNamespaceSelectorsFromNamespaceLister of the file pkg/utils/engine/labels.go. Executing a manipulation can lead to improper validation of specified type of input. This vulnerability is tracked as CVE-2025-46342. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Kyverno up to 1.13.4/1.13.x and classified as critical. This vulnerability affects the function GetNamespaceSelectorsFromNamespaceLister of the file pkg/utils/engine/labels.go. The manipulation with an unknown input leads to a improper validation of specified type of input vulnerability. The CWE definition for the vulnerability is CWE-1287. The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-46342 since 04/23/2025. The exploitation appears to be difficult. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.13.5 or 1.14.0 eliminates this vulnerability. Applying the patch 3ff923b7756e1681daf73849954bd88516589194 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Kyverno

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.13.0
• 1.13.1
• 1.13.2
• 1.13.3
• 1.13.4

License

• open-source

Website

• Product: https://github.com/kyverno/kyverno/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion