Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Kyverno lets tenants access other namespaces and become admin

CVE-2026-124440 · published 1 day ago
Summary

Versions 1.19.1 of Kyverno allow a tenant to send specially crafted requests that bypass normal checks, letting them read data from other namespaces and create objects that give them cluster‑wide rights. This can lead to a user gaining full control of the Kubernetes cluster. Update Kyverno to version 1.19.2 or newer and review any existing policies that use the apiCall feature.

Original advisory text
Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass
Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers can create namespaced Policies whose apiCall runs as the admission-controller ServiceAccount to read other namespaces' resources and create mutating webhooks, escalating to cluster admin.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
Timeline
Published8 Nov 2026
Updated9 Nov 2026
First seen8 Nov 2026
Sources
CVE-2026-124440 · NVD
CVE-2026-124440 · OSV
GHSA-39w8-hv5g-f73w · GHSA
Track software like this
Free during beta