Critical vulnerability in Kyverno v1.18.1 allows cross-namespace RoleBinding creation

Kyverno v1.18.1 has a critical vulnerability, as described in the GitHub Security Advisory database. The issue lies in the NamespacedGeneratingPolicy's `generator.apply()` function, which fails to validate the `namespace` argument. This allows a tenant with permissions to create a NamespacedMutatingPolicy in their own namespace to generate resources in any namespace, including sensitive ones like `kube-system`. The vulnerability arises from the admission controller executing these requests with cluster-wide privileges.

The root cause is traced to the absence of namespace scope validation in the `generator.apply()` arguments within the admission validator for NamespacedMutatingPolicy. Unlike other components in Kyverno that enforce namespace segment matching, the `GenerateResources` function lacks such guards. This oversight enables unintended cross-namespace resource creation, exposing the cluster to privilege escalation risks.

Operators should carefully assess the permissions granted to tenants, especially those involving NamespacedMutatingPolicy creation. Before upgrading or applying policies, it is crucial to ensure that no tenant has the ability to exploit this vulnerability. Additionally, operators should monitor for unusual RoleBinding creation activity in sensitive namespaces and consider restricting NamespacedMutatingPolicy usage until a patched version is available. This vulnerability highlights the importance of validating namespace arguments in policy-related functions, a pattern that other projects should also scrutinize.