CVE-2026-122312

HIGH 7.7

Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.

CWE	CWE-269
Vendor	kyverno
Product	kyverno
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for kyverno kyverno

Be the first to know when new high vulnerabilities affecting kyverno kyverno are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

kyverno / kyverno

1.19.1 < 1.19.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/kyverno/kyverno/security/advisories/GHSA-pcx2-xcq4-65vf github.com: https://github.com/kyverno/kyverno/commit/f67231def576eb0ad153dd8cbfc836908ab14c14 vulncheck.com: https://www.vulncheck.com/advisories/kyverno-1.19.1-before-1.19.2-namespace-isolation-bypass-via-apicall-urlpath-query-string

Credits

aradcohAkamai