Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.

Kyverno versions v1.9.0 through v1.12.7 contain a flaw in policy exception handling. When a policy running in enforce mode is combined with two PolicyExceptions, the less restrictive exception incorrectly takes precedence over the more restrictive one. An attacker can exploit this by crafting a resource name that matches the second exception's wildcard name pattern (e.g., '*ingress*'), effectively bypassing enforced policies. This vulnerability can be used to circumvent critical security policies, such as those blocking hostPath volume mounts in Kubernetes workloads. The issue represents a security control bypass in a Kubernetes-native policy engine widely used for admission control. The flaw was fixed in Kyverno v1.13.0. Organizations running affected versions should upgrade immediately to mitigate the risk of policy bypass attacks.