CVE-2026-122316
HIGH
NVD
CVSS Score
8.5
Severity
HIGH
Published
Nov 05, 2026
Vendor
unknown
Description
Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions, making the background-controller ServiceAccount strip Pod Security labels cluster-wide.