CVE-2026-29773 Details
Description
Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy namespaced AdmissionPolicies and AdmissionPolicyGroups in their Namespaces. One of Kubewarden promises is that configured users can deploy namespaced policies in a safe manner, without privilege escalation. An attacker with privileged "AdmissionPolicy" create permissions (which isn't the default) could make use of 3 deprecated host-callback APIs: kubernetes/ingresses, kubernetes/namespaces, kubernetes/services. The attacker can craft a policy that exercises these deprecated API calls and would allow them read access to Ingresses, Namespaces, and Services resources respectively. This attack is read-only, there is no write capability and no access to Secrets, ConfigMaps, or other resource types beyond these three.
A vulnerability in Kubewarden, a policy engine for Kubernetes, allows for cross-namespace data exfiltration via deprecated host callback bindings. This issue affects Kubewarden version 1.6.0 and arises from the ability of users with 'AdmissionPolicy' create permissions to deploy namespaced policies that access Ingress, Namespace, and Service resources. The vulnerability has been patched in version 1.33.0 by removing the deprecated host callbacks and replacing them with more efficient and context-aware alternatives. However, the vulnerability could be exploited by crafting a policy that utilizes the old APIs to read sensitive information from other namespaces, such as namespace labels, service details including ClusterIPs and ports, and ingress routing rules.
To address this vulnerability, Kubewarden operators should update the policy-server image used by their PolicyServers to version 1.33.0. Alternatively, operators can temporarily reduce the permissions of users to prevent them from creating or updating namespaced AdmissionPolicies or AdmissionPolicyGroups.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation kubewarden | >= 1.6.0, < 1.33.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |