by Kastro
Paper/Archive/CVE-2026-122304

CVE-2026-122304

kyverno kyverno — Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader

CVSS 9.9
critical.is priorityof 100
30
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.

Affected

ProductAffectedFixed inSource
kyverno1.17.0 – < 1.19.21.19.2CNA

Scores by source

VulnCheck (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

advisorygithub.com/kyverno/kyverno/security/advisories/GHSA-p58h-r4j3-h5vxadvisorygithub.com/kyverno/kyverno/security/advisories/GHSA-rcxg-3f92-3mgrwriteupvulncheck.com/advisories/kyverno-1.17.0-before-1.19.2-privilege-escalation-via-cleanuppolicy-context-loader