Information Disclosure Vulnerability in Kubewarden Kubernetes Policy Engine
CVE-2026-42541

4.3MEDIUM

Key Information:

Vendor

Kubewarden

Status
Kubewarden-controller
Vendor
CVE Published:
12 May 2026

What is CVE-2026-42541?

The Kubewarden policy engine for Kubernetes has a vulnerability that allows an attacker with special permissions to exploit the can_i host callback. By crafting a harmful policy, an attacker can initiate SubjectAccessReview requests to probe RBAC permissions for any user or service account within the cluster. This capability creates an authorization gap, enabling attackers to discern valuable permission information such as access rights to secrets or pod creation in designated namespaces, without directly exfiltrating sensitive workload data.

Affected Version(s)

kubewarden-controller < 1.35.0

References

https://github.com/kubewarden/adm-controller/security/adv...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.