CVE-2026-122303: Kyverno Cross-Namespace Mutation
CVE-2026-122303 is an authorization bypass in Kyverno from 1.17.0 up to (not including) 1.19.2. It is scored CVSS 9.9 (Critical).
Namespace tenants can overwrite resources in other namespaces through a NamespacedMutatingPolicy that uses mutate-existing with targetMatchConstraints.expression. An attacker returns a CEL map literal that fabricates a target object, which sidesteps the namespace confinement the policy is meant to enforce.
Key Facts
| Field | Detail |
|---|---|
| CVE | CVE-2026-122303 |
| Severity | Critical (CVSS 9.9) |
| Product | Kyverno |
| Affected | 1.17.0 up to, but not including, 1.19.2 |
| Fixed in | 1.19.2 |
| Prerequisite | Ability to create a NamespacedMutatingPolicy |
| Published | 2026-11-05 |
Why It Matters
Namespaced policies exist so that tenants can manage their own rules without affecting neighbors. This flaw breaks that promise: any tenant who can create a mutating policy can modify workloads, ConfigMaps, or other objects in namespaces they do not own. In shared clusters that is a full tenant-isolation failure.
Remediation
- Upgrade Kyverno to 1.19.2 or later.
- Restrict who can create
NamespacedMutatingPolicyobjects until the upgrade is complete. - Audit existing NamespacedMutatingPolicies that use
mutate-existing, especially any with atargetMatchConstraints.expression. - Review recent changes to resources in sensitive namespaces for unexpected mutations.