CVE-2025-46342: 
Wolfi vulnerability analysis and mitigation

Kyverno, a policy engine designed for cloud native platform engineering teams, was found to have a critical vulnerability (CVE-2025-46342) affecting versions prior to 1.13.5 and 1.14.0. The vulnerability was discovered by anbrsap and publicly disclosed on April 29, 2025. The issue stems from a missing error propagation in the GetNamespaceSelectorsFromNamespaceLister function within pkg/utils/engine/labels.go, which affects policy rules using namespace selector(s) in their match statements during admission review request processing (GitHub Advisory).

The vulnerability occurs when handling admission webhooks, where the GetNamespaceSelectorsFromNamespaceLister function fails to propagate errors when retrieving namespace object labels from a NamespaceLister, instead returning an empty label map. This happens particularly when the underlying SharedIndexInformer hasn't updated its cache. The issue has been assigned a CVSS v3.1 base score of 8.5 (High), with attack vector: Network, attack complexity: High, privileges required: Low, user interaction: None, scope: Changed, and impact metrics all rated as High (GitHub Advisory, NVD).

The vulnerability allows security-critical mutations and validations to be bypassed, potentially enabling attackers with Kubernetes API access to perform malicious operations. When triggered, Kyverno processes admission review requests as if certain policy rules don't exist, leading to Kubernetes API requests being accepted without applying necessary security-relevant patches and validations. This particularly affects administrators attempting to enforce cluster security through Kyverno policies while allowing less privileged users or service accounts to create/update/delete resources (GitHub Advisory).

The vulnerability has been patched in Kyverno versions 1.13.5 and 1.14.0. The fix involves modifying the GetNamespaceSelectorsFromNamespaceLister function to return an error instead of an empty label map when it cannot retrieve the namespace object. This causes admission webhook processing to fail, leading Kubernetes to fail the API request if the policy's failure policy is set to Fail (GitHub Advisory).