CVE-2026-42541 Details
Description
Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions (which isn't the default) can craft a policy that makes use of the can_i host callback. The callback issues a SubjectAccessReview (SAR) requests to enumerate RBAC permissions of any user or service account across the cluster. can_i does not perform that check to enforce the context-aware allow-list and forwards the request directly to the callback handler, which executes a real SubjectAccessReview using policy-server privileges. This creates a policy-level authorization gap: can_i is effectively usable even when the policy has no context-aware resource grant. This is an information disclosure / reconnaissance issue, and not direct workload data exfiltration. The attacker learns permission information, such as whether specific service accounts can "get secrets", "create pods", or "bind clusterroles" in chosen namespaces. This vulnerability is fixed in .
A vulnerability exists in Kubewarden, a policy engine for Kubernetes, specifically in version 1.32.0. It allows an attacker with certain privileges to craft a policy that exploits the 'can_i' host callback. This callback bypasses context-aware resource grants and uses policy-server privileges to perform SubjectAccessReview requests, enabling the attacker to enumerate RBAC permissions of any user or service account in the cluster. While this vulnerability does not directly exfiltrate workload data, it creates an authorization gap that could be exploited for information disclosure and reconnaissance purposes.
To address this vulnerability, cluster operators should deploy PolicyServers with reduced permissions for host capability calls. This can be done by setting the 'PolicyServer.spec.namespacedPoliciesCapabilities' to an empty list for custom PolicyServers or the default PolicyServer. Operators can also remove SubjectAccessReview 'create' permissions for the PolicyServer ServiceAccount RBAC being used.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kubewarden/adm-controller/security/advisories/GHSA-wqcw-g35j-j578 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kubewarden | All versions |
CPE
Remediation
| |
| Kubewarden adm-controller | All versions |
CPE
Remediation
| |
| Kubewarden defaults | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |