CVE-2024-48921

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
kyverno	kyverno	< 1.13.0
kyverno	kyverno	< 1.13.0

References

https://github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rmExploit, Vendor Advisory

Timeline

Published: Oct 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-489248.7### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attac CVE-2024-489256.5Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior to CVE-2024-489263.1Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch CVE-2024-489274.6Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13 CVE-2024-489287.5Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuratio CVE-2024-489294.2Umbraco is a free and open source .NET content management system. In versions on the 13.x branch prior to 13.5.2 and versions on the 10.x br CVE-2024-48939.8DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulner CVE-2024-489308.7secp256k1-node is a Node.js binding for an Optimized C library for EC operations on curve secp256k1. In `elliptic`-based version, `loadUncom CVE-2024-489317.5ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the CVE-2024-489325.3ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In versions below 1.5.0, the API endpoint `ht CVE-2024-489336.1A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML int CVE-2024-489365.0SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execut