title: Bypassing policies imposed by the ImagePolicyWebhook admission plugin
description: Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: Kubernetes
vendor: Kubernetes
versions:
lessThanOrEqual: <=, status: affected, version: v1.24.14, versionType: semver
status: affected, version: v1.25.0 - v1.25.10
status: affected, version: v1.26.0 - v1.26.5
status: affected, version: v1.27.0 - v1.27.2
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: To mitigate this vulnerability, upgrade Kubernetes:  https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster
workarounds: Prior to upgrading, this vulnerability can be mitigated by running validation webhooks (such as Gatekeeper and Kyverno) to enforce the same restrictions for ephemeral containers.