CVE-2024-48921 - CVE House
Back to Database
Status published High CVE-2024-48921

Kyverno's PolicyException objects can be created in any namespace by default

Vulnerability Description

Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-48921

Credits & Attribution

No credits recorded in the NVD database.

References

More from kyverno

View All →
CVE-2025-47281
Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service
High 7.7
CVE-2025-46342
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements
High 8.6
CVE-2025-29778
Kyverno ignores subjectRegExp and IssuerRegExp
Medium 5.8
CVE-2023-47630
Attacker can cause Kyverno user to unintentionally consume insecure image
High 7.1
CVE-2023-42816
Denial of service from malicious signature in kyverno
Medium 6.1

Affected Vendor

Affected Software

kyverno
Vulnerable Versions:
< 1.13.0

Timeline

Official Publish: October 29th, 2024
Last Modified: October 29th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-285

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion