PT-2023-24664 · Unknown+1 · Kubernetes Service+3

Bburky · Published 2023-06-01 · Updated 2026-04-16 · CVE-2023-34091

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.10.0

Description The issue allows resources with the deletionTimestamp field defined to bypass validate, generate, or mutate-existing policies, even when the validationFailureAction field is set to Enforce. This occurs because resources pending deletion were exempted by Kyverno to reduce processing load. A malicious user could leverage the Kubernetes finalizers feature by setting a finalizer, causing the Kubernetes API server to set the deletionTimestamp, and then not completing the delete operation to bypass a Kyverno policy. For example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This issue is not applicable to Kubernetes Pods.

Recommendations For Kyverno versions prior to 1.10.0, update to Kyverno 1.10.0 to resolve the issue. As a temporary workaround, consider restricting the use of the Kubernetes finalizers feature to minimize the risk of exploitation. Avoid using indefinite finalizers for resources, such as Kubernetes Service resources, until the issue is resolved. Note that there is no known workaround for this issue.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CLEANSTART-2026-UQ68343

CLEANSTART-2026-WI71304

CVE-2023-34091

ECHO-AD8E-08F8-44CD

GHSA-HQ4M-4948-64CC

GO-2023-1819

Affected Products

Kubernetes

Kubernetes Pods

Kubernetes Service

Kyverno

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34091.json · Exploit
• https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34091 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22039 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61726 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-46342 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33810 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32283 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-WI71304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25679 · Security Note