CVE-2026-122313

CRITICAL 9.9

Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target such as another tenant's RoleBinding, which the cluster-wide background controller then mutates to add attacker subjects or alter Roles, NetworkPolicies, and ConfigMaps.

CWE	CWE-269
Vendor	kyverno
Product	kyverno
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for kyverno kyverno

Be the first to know when new critical vulnerabilities affecting kyverno kyverno are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

kyverno / kyverno

1.17.0 < 1.19.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/kyverno/kyverno/security/advisories/GHSA-f96w-622v-rqpq vulncheck.com: https://www.vulncheck.com/advisories/kyverno-1.17.0-before-1.19.2-cross-namespace-privilege-escalation-via-namespacedmutatingpolicy

Credits

manus-use