Critical
9.9
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows...
CVE-2026-122304
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| kyverno | kyverno |
≥ 1.17.0, < 1.19.2 |
1.19.2 |
Original description The description as published by the source.
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web nvd.nist.gov
- web github.com