Skip to content

CVE record · 1 source

CVE-2026-122310

CVSS 9.9

Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query…

Vendor: Kyverno
Product: kyverno
CVSS v3.1: 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-436
Exposure class: Developer platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

38

CVE NVD 18h ago

Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query…

Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy…

CVSS 9.9 CVE-2026-122310 Kyverno