Critical
9.9
Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows...
CVE-2026-122313
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| kyverno | kyverno |
≥ 1.17.0, < 1.19.2 |
1.19.2 |
Original description The description as published by the source.
Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target such as another tenant's RoleBinding, which the cluster-wide background controller then mutates to add attacker subjects or alter Roles, NetworkPolicies, and ConfigMaps.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web disclosure@vulncheck.com
- web disclosure@vulncheck.com
- web nvd.nist.gov
- web github.com