CVE-2026-122302: Kyverno Privilege Escalation via Generate Rules
CVE-2026-122302 is a privilege escalation flaw in Kyverno before version 1.19.2. Admission checks for generate rules verify the permissions of the Kyverno controller rather than the permissions of the user who authored the policy. A namespace admin can therefore create resources they are not authorized to create.
The CNA (VulnCheck) scores it CVSS 3.1 9.8 (Critical) and CVSS 4.0 9.3. The weakness is CWE-269 (Improper Privilege Management). The GitHub advisory is GHSA-q62c-r9v2-cf64.
How It Works
An attacker with rights to create a namespaced Policy writes one with generate rules that target other namespaces or cluster-scoped kinds. Kyverno's background controller, which holds broad permissions, then creates or clones those resources cluster-wide on the attacker's behalf.
Key Facts
| Field | Detail |
|---|---|
| CVE | CVE-2026-122302 |
| Severity | Critical (CVSS 9.8) |
| Product | Kyverno (Kubernetes policy engine) |
| Affected | Versions before 1.19.2 |
| Fixed in | 1.19.2 |
| Prerequisite | Ability to create a namespaced Policy (namespace admin) |
| Published | 2026-11-05 |
Related Kyverno CVEs Fixed in 1.19.2
Version 1.19.2 fixes a cluster of multi-tenancy flaws. Others published the same day include CVE-2026-122303, CVE-2026-122304, CVE-2026-122310, CVE-2026-122311, as well as CVE-2026-122308 (CVSS 8.5) and CVE-2026-122312 (CVSS 8.3).
Remediation
- Upgrade Kyverno to 1.19.2 or later (Helm chart and images).
- Review who can create
Policyobjects in namespaces. Until patched, treat that permission as close to cluster-admin. - Audit existing namespaced Policies for
generaterules that target other namespaces or cluster-scoped kinds. - Check for unexpected generated resources, such as RoleBindings, ClusterRoles, and Secrets, created by the Kyverno background controller.