Vulnerabilities

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other…

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Kyverno

Product

kyverno

CVSS v3.1

9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness

CWE-862

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-122303 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 33
   CVE NVD 19h ago

   Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other…

   CVSS 9.9 CVE-2026-122313 Kyverno
2. 33
   CVE NVD 19h ago

   Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because…

   CVSS 9.9 CVE-2026-122304 Kyverno