CVE-2026-122304

Description

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.

References

• https://github.com/kyverno/kyverno/security/advisories/GHSA-p58h-r4j3-h5vx
• https://github.com/kyverno/kyverno/security/advisories/GHSA-rcxg-3f92-3mgr
• https://www.vulncheck.com/advisories/kyverno-1.17.0-before-1.19.2-privilege-escalation-via-cleanuppolicy-context-loader