Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Kyverno allows an attacker with existing access to steal credentials. These credentials could then be used to gain full control of your cluster.
- Stolen credentials grant full cluster control.
- Affects systems using Kyverno's apiCall feature.
- Requires existing access to exploit.
Attack Path
How an attacker could exploit the issue
An attacker with cluster administrator privileges can weaponize this by creating a Kyverno `ClusterPolicy` that uses the `apiCall` feature to send the admission controller's ServiceAccount token to an attacker-controlled server. This allows them to steal the token, which has permissions to modify webhook configurations, leading to full cluster compromise.
- Internal attacker with admin rights
- Malicious `ClusterPolicy` creation
- Stolen SA token grants cluster control
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in Kyverno allows an attacker to steal a service account token with broad permissions, enabling full cluster compromise. While the vulnerability itself is severe, its exploitability is limited to attackers who already have a foothold within the Kubernetes cluster. There are no immediate public exploit proofs of concept, and no observed exploitation in the wild.
- Exploitation requires internal access.
- No public exploits are known.
- No KEV signals observed.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize upgrading Kyverno to a patched version immediately. The vulnerability allows for full cluster compromise by an authenticated attacker who can manipulate policies. If patching is delayed, focus on monitoring network traffic and the admission controller's ServiceAccount token for suspicious activity.
- Upgrade Kyverno to patched versions.
- Monitor for unusual network requests.
- Restrict ServiceAccount token access.
