Kyverno NamespacedMutatingPolicy generator.apply() cross-namespace resource generation bypass

#!/usr/bin/env bash
# check_cve_2026_54523.sh — Detect CVE-2026-54523 exposure in Kyverno
# Checks: (1) Kyverno version, (2) NamespacedMutatingPolicy RBAC grants
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

RESULT="UNKNOWN"
VULN_VERSIONS=("v1.18.0" "v1.18.1" "1.18.0" "1.18.1")

# --- Step 1: Detect Kyverno version ---
KYVERNO_NS="${KYVERNO_NS:-kyverno}"
VERSION=$(kubectl get deployment -n "$KYVERNO_NS" -l app.kubernetes.io/component=admission-controller \
  -o jsonpath='{.items[0].spec.template.spec.containers[0].image}' 2>/dev/null || true)

if [ -z "$VERSION" ]; then
  echo "[!] Could not detect Kyverno admission-controller deployment in namespace '$KYVERNO_NS'."
  echo "    Set KYVERNO_NS env var if Kyverno is in a different namespace."
  echo "UNKNOWN"
  exit 2
fi

# Extract version tag from image string (e.g., ghcr.io/kyverno/kyverno:v1.18.1)
VER_TAG=$(echo "$VERSION" | grep -oP '(?<=:)v?[0-9]+\.[0-9]+\.[0-9]+' || echo "")
echo "[*] Kyverno image: $VERSION"
echo "[*] Detected version tag: ${VER_TAG:-unable to parse}"

IS_VULN_VERSION=false
for v in "${VULN_VERSIONS[@]}"; do
  if [ "$VER_TAG" = "$v" ]; then
    IS_VULN_VERSION=true
    break
  fi
done

if [ "$IS_VULN_VERSION" = true ]; then
  echo "[!] VULNERABLE VERSION DETECTED: $VER_TAG (affected: v1.18.0, v1.18.1)"
  RESULT="VULNERABLE"
else
  echo "[+] Version $VER_TAG is not in the affected range (v1.18.0, v1.18.1)."
  RESULT="PATCHED"
fi

# --- Step 2: Check for NamespacedMutatingPolicy RBAC grants to non-system subjects ---
echo ""
echo "[*] Auditing RBAC for namespacedmutatingpolicies.kyverno.io create grants..."

GRANTS=$(kubectl get clusterrolebindings,rolebindings -A -o json 2>/dev/null | \
  jq -r '
    [.items[] |
      .subjects[]? as $subj |
      select(.roleRef.kind == "ClusterRole" or .roleRef.kind == "Role") |
      {binding: .metadata.name, ns: .metadata.namespace, subject: $subj.name, kind: $subj.kind, role: .roleRef.name}
    ] | .[] | "\(.binding) -> \(.subject) (\(.kind)) via \(.role) in ns=\(.ns // "cluster-wide")"' 2>/dev/null || echo "")

NMPOL_ROLES=$(kubectl get clusterroles,roles -A -o json 2>/dev/null | \
  jq -r '.items[] | select(.rules[]? | select(
    (.apiGroups[]? == "kyverno.io" or .apiGroups[]? == "*") and
    (.resources[]? == "namespacedmutatingpolicies" or .resources[]? == "*") and
    (.verbs[]? == "create" or .verbs[]? == "*")
  )) | .metadata.name' 2>/dev/null || echo "")

if [ -n "$NMPOL_ROLES" ]; then
  echo "[!] Roles/ClusterRoles granting create on namespacedmutatingpolicies:"
  echo "$NMPOL_ROLES" | while read -r role; do
    echo "    - $role"
  done
  if [ "$RESULT" = "VULNERABLE" ]; then
    echo "[!!] VULNERABLE: Kyverno $VER_TAG + RBAC grants for NamespacedMutatingPolicy creation exist."
  fi
else
  echo "[+] No roles granting create on namespacedmutatingpolicies found."
  if [ "$RESULT" = "VULNERABLE" ]; then
    echo "[*] Version is vulnerable but no RBAC grants detected — exploitation unlikely without RBAC change."
  fi
fi

echo ""
echo "$RESULT"
exit $([ "$RESULT" = "PATCHED" ] && echo 0 || ([ "$RESULT" = "VULNERABLE" ] && echo 1 || echo 2))