Critical
9.9
Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of...
CVE-2026-122311
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| kyverno | kyverno |
≥ 1.16.0, < 1.19.2 |
1.19.2 |
Original description The description as published by the source.
Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web nvd.nist.gov
- web github.com