CVE-2026-122311
CRITICAL
NVD
CVSS Score
9.9
Severity
CRITICAL
Published
Nov 05, 2026
Vendor
unknown
Description
Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.