0Xvijay

**Name of the Vulnerable Software and Affected Versions** Kyverno versions 1.18.0 through 1.18.1 **Description** In the NamespacedMutatingPolicy CEL compiler, the `generator` library is exposed to `matchConditions`, allowing a namespace-scoped policy to invoke the `generator.apply(namespace, resources)` function with an arbitrary target namespace. The validation process in `pkg/cel/policies/mpol/validate.go` only verifies that the policy compiles without enforcing namespace scope, and the `GenerateResources()` function in `pkg/cel/libs/context.go` fails to reject cross-namespace targets. A user with permissions to create `NamespacedMutatingPolicy` objects in a specific namespace can exploit this to force the admission controller, which operates with cluster-wide privileges, to create resources such as ConfigMaps, NetworkPolicies, Secrets, and RoleBindings in any other namespace. This can lead to unauthorized modification of protected namespaces (e.g., `kube-system`) and potential privilege escalation to cluster administrator levels. **Recommendations** Update Kyverno to version 1.18.2. As a temporary mitigation, restrict user permissions to prevent non-admin users from creating `NamespacedMutatingPolicy` objects.

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.11.42 Traefik versions prior to 3.6.12 Traefik versions prior to 3.7.0-ea.3 **Description** Traefik, an HTTP reverse proxy and load balancer, is susceptible to an identity impersonation issue. When the `headerField` configuration option is used with a non-canonical HTTP header name (for example, `x-auth-user` instead of `X-Auth-User`), an authenticated attacker can inject a canonical version of that header. This allows the attacker to impersonate any identity to the backend service. The backend receives two header entries, with the attacker-injected canonical version being read first, overriding Traefik's non-canonical write. This issue affects the Basic and Digest authentication middlewares. The vulnerability occurs because Traefik writes the authenticated username using a non-canonical map key, creating a separate header entry instead of overwriting the attacker's canonical one. **Recommendations** Traefik versions prior to 2.11.42 should be updated to version 2.11.42 or later. Traefik versions prior to 3.6.12 should be updated to version 3.6.12 or later. Traefik versions prior to 3.7.0-ea.3 should be updated to version 3.7.0-ea.3 or later.