diff --git a/pkg/stores/proxy/proxy_store.go b/pkg/stores/proxy/proxy_store.go
index fb01dd81..82d3c0dc 100644
--- a/pkg/stores/proxy/proxy_store.go
+++ b/pkg/stores/proxy/proxy_store.go
@@ -205,9 +205,10 @@ func tableToObjects(obj map[string]interface{}) []unstructured.Unstructured {
 // be returned in the list.
 func (s *Store) ByNames(apiOp *types.APIRequest, schema *types.APISchema, names sets.String) (*unstructured.UnstructuredList, []types.Warning, error) {
 	if apiOp.Namespace == "*" {
-		// This happens when you grant namespaced objects with "get" by name in a clusterrolebinding. We will treat
-		// this as an invalid situation instead of listing all objects in the cluster and filtering by name.
-		return nil, nil, nil
+		// This happens when you grant namespaced objects with "get" or "list "by name in a clusterrolebinding.
+		// We will treat this as an invalid situation instead of listing all objects in the cluster
+		// and filtering by name.
+		return &unstructured.UnstructuredList{}, nil, nil
 	}
 	buffer := WarningBuffer{}
 	adminClient, err := s.clientGetter.TableAdminClient(apiOp, schema, apiOp.Namespace, &buffer)
diff --git a/pkg/stores/proxy/proxy_store_test.go b/pkg/stores/proxy/proxy_store_test.go
index 75c290ca..ad1d352c 100644
--- a/pkg/stores/proxy/proxy_store_test.go
+++ b/pkg/stores/proxy/proxy_store_test.go
@@ -68,6 +68,18 @@ func TestWatchNamesErrReceive(t *testing.T) {
 	assert.Equal(t, 0, len(c.ResultChan()), "Expected all secrets to have been received")
 }
 
+func TestByNames(t *testing.T) {
+	s := Store{}
+	apiSchema := &types.APISchema{Schema: &schemas.Schema{}}
+	apiOp := &types.APIRequest{Namespace: "*", Schema: apiSchema, Request: &http.Request{}}
+	names := sets.NewString("some-resource", "some-other-resource")
+	result, warn, err := s.ByNames(apiOp, apiSchema, names)
+	assert.NotNil(t, result)
+	assert.Len(t, result.Items, 0)
+	assert.Nil(t, err)
+	assert.Nil(t, warn)
+}
+
 func (t *testFactory) TableAdminClientForWatch(ctx *types.APIRequest, schema *types.APISchema, namespace string, warningHandler rest.WarningHandler) (dynamic.ResourceInterface, error) {
 	return t.fakeClient.Resource(schema2.GroupVersionResource{}), nil
 }