Brianwillows

**Name of the Vulnerable Software and Affected Versions** Kyverno versions 1.16.0 through 1.19.0 **Description** The software registers the `globalcontext.Lib` Common Expression Language (CEL) library in its policy environment without restricting it to the policy's namespace. This differs from other libraries like `resource.Lib`, `http.Lib`, and the configMap loader, which are confined to the policy namespace. A tenant with permissions to create namespaced policies, such as `NamespacedValidatingPolicy` or similar mutating, deleting, generating, and image-validating policies, can use the `globalContext.get()` function to retrieve the full cached contents of a cluster-scoped `GlobalContextEntry`. This allows access to data cached from namespaces for which the tenant lacks RBAC (Role-Based Access Control) permissions, as no admission validation prevents these calls. **Recommendations** Update Kyverno to version 1.19.1.