Kyverno PolicyException Precedence Bypass

Technical Analysis

The vulnerability arises when a Kubernetes cluster has an enforce-mode Kyverno policy combined with two overlapping PolicyExceptions; Kyverno incorrectly prioritizes the less restrictive exception over the more restrictive one. An attacker with the ability to create or name workloads (e.g., naming a resource to match a wildcard pattern like '*ingress*') can trigger the permissive exception and bypass policies designed to block dangerous configurations such as hostPath volume mounts. This effectively neutralizes admission control guardrails, opening a path to host filesystem access, privilege escalation, and lateral movement within the cluster. Given the CVSS score of 9.0, exploitation requires only namespace-level workload creation permissions, making it accessible to low-privileged insiders or compromised service accounts. Organizations running AI agent orchestration frameworks (e.g., Kubernetes-based agent execution environments, RAG pipeline workers, or LLM tool-execution pods) on affected Kyverno versions are at risk of agent workloads bypassing sandboxing policies, potentially escaping containers to access host secrets, API keys, or model weights.

Affected Systems

Kyverno versions v1.9.0 through v1.12.7 deployed as a Kubernetes admission controller; clusters using enforce-mode ClusterPolicies or Policies combined with two or more PolicyExceptions; particularly impactful where policies restrict hostPath volumes, privileged containers, or other host-level access controls.

Indicators of Compromise

• No specific file hashes, IPs, or domains applicable (logic/configuration vulnerability); indicators include: unexpected PolicyException resources with overlapping match patterns, workloads with names matching wildcard exception patterns (e.g., containing 'ingress'), unauthorized hostPath volume mounts in pod specs, audit log entries showing policy evaluation anomalies for enforce-mode policies.

Remediation Steps

1. 1

   Upgrade Kyverno

   Upgrade to Kyverno v1.13.0 or later, which resolves the PolicyException precedence flaw.

2. 2

   Audit PolicyExceptions

   Review all existing PolicyException resources for overlapping match criteria and remove or consolidate exceptions with overly broad wildcard patterns.

3. 3

   Restrict PolicyException creation

   Limit RBAC permissions for creating or modifying PolicyException resources to trusted cluster administrators only.

4. 4

   Enable audit logging

   Monitor Kubernetes and Kyverno audit logs for policy bypass attempts, unusual resource naming patterns, and unauthorized hostPath usage.

5. 5

   Validate policy enforcement

   After upgrading, test enforce-mode policies against known bypass patterns to confirm the fix is effective in your environment.

6. 6

   Harden agent workload isolation

   For clusters running AI agent or LLM tool-execution workloads, apply defense-in-depth controls (e.g., PodSecurity admission, seccomp, read-only root filesystems) independent of Kyverno to reduce reliance on a single policy layer.