VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Mar 10, 2026· Updated May 13, 2026

CVE-2026-29773

CVE-2026-29773

Description

Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy namespaced AdmissionPolicies and AdmissionPolicyGroups in their Namespaces. One of Kubewarden promises is that configured users can deploy namespaced policies in a safe manner, without privilege escalation. An attacker with privileged "AdmissionPolicy" create permissions (which isn't the default) could make use of 3 deprecated host-callback APIs: kubernetes/ingresses, kubernetes/namespaces, kubernetes/services. The attacker can craft a policy that exercises these deprecated API calls and would allow them read access to Ingresses, Namespaces, and Services resources respectively. This attack is read-only, there is no write capability and no access to Secrets, ConfigMaps, or other resource types beyond these three.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/kubewarden/kubewarden-controllerGo
< 1.33.01.33.0

Affected products

1

Patches

1
4e41b60ae449

Merge pull request #1519 from jvanz/remove-deprecated-wapc-bindind

https://github.com/kubewarden/kubewarden-controllerFlavio CastelliFeb 26, 2026via ghsa
commit
1 file changed · +1 −88
  • crates/policy-evaluator/src/runtimes/callback.rs+1 −88 modified
    @@ -9,7 +9,7 @@ use kubewarden_policy_sdk::host_capabilities::{
     },
 };
 use tokio::sync::{mpsc, oneshot, oneshot::Receiver};
-use tracing::{debug, error, warn};
+use tracing::{debug, error};
 
 use crate::callback_requests::{CallbackRequest, CallbackRequestType, CallbackResponse};
 use crate::evaluation_context::EvaluationContext;
@@ -335,93 +335,6 @@ pub(crate) fn host_callback(
             },
             _ => unknown_namespace(namespace),
         },
-        "kubernetes" => match namespace {
-            "ingresses" => {
-                let req = CallbackRequestType::KubernetesListResourceAll {
-                    api_version: "networking.k8s.io/v1".to_string(),
-                    kind: "Ingress".to_string(),
-                    label_selector: None,
-                    field_selector: None,
-                    field_masks: None,
-                };
-
-                warn!(
-                    eval_ctx.policy_id,
-                    ?req,
-                    "Usage of deprecated `ClusterContext`"
-                );
-                let (tx, rx) = oneshot::channel::<Result<CallbackResponse>>();
-                let req = CallbackRequest {
-                    request: req,
-                    response_channel: tx,
-                };
-                send_request_and_wait_for_response(
-                    &eval_ctx.policy_id,
-                    binding,
-                    operation,
-                    req,
-                    rx,
-                    eval_ctx,
-                )
-            }
-            "namespaces" => {
-                let req = CallbackRequestType::KubernetesListResourceAll {
-                    api_version: "v1".to_string(),
-                    kind: "Namespace".to_string(),
-                    label_selector: None,
-                    field_selector: None,
-                    field_masks: None,
-                };
-
-                warn!(
-                    eval_ctx.policy_id,
-                    ?req,
-                    "Usage of deprecated `ClusterContext`"
-                );
-                let (tx, rx) = oneshot::channel::<Result<CallbackResponse>>();
-                let req = CallbackRequest {
-                    request: req,
-                    response_channel: tx,
-                };
-                send_request_and_wait_for_response(
-                    &eval_ctx.policy_id,
-                    binding,
-                    operation,
-                    req,
-                    rx,
-                    eval_ctx,
-                )
-            }
-            "services" => {
-                let req = CallbackRequestType::KubernetesListResourceAll {
-                    api_version: "v1".to_string(),
-                    kind: "Service".to_string(),
-                    label_selector: None,
-                    field_selector: None,
-                    field_masks: None,
-                };
-
-                warn!(
-                    eval_ctx.policy_id,
-                    ?req,
-                    "Usage of deprecated `ClusterContext`"
-                );
-                let (tx, rx) = oneshot::channel::<Result<CallbackResponse>>();
-                let req = CallbackRequest {
-                    request: req,
-                    response_channel: tx,
-                };
-                send_request_and_wait_for_response(
-                    &eval_ctx.policy_id,
-                    binding,
-                    operation,
-                    req,
-                    rx,
-                    eval_ctx,
-                )
-            }
-            _ => unknown_namespace(namespace),
-        },
         _ => {
             error!(binding, "unknown binding");
             Err(format!("unknown binding: {binding}").into())

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.