SECURITYCRITICALCVE-2026-122310

CVE-2026-122310: Kyverno apiCall urlPath Validation Bypass Reaches Cluster-Scoped Endpoints

Kyverno 1.19.1 validates a cleaned urlPath but runs the raw one; hiding ../ behind # or ? lets namespace users reach cluster endpoints (CVSS 9.9).

Dylan H.

Security Team

November 5, 2026
2 min read
CVE-2026-122310: Kyverno apiCall urlPath Validation Bypass Reaches Cluster-Scoped Endpoints

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Kyverno 1.19.1 (fixed in 1.19.2)

CVE-2026-122310: Kyverno urlPath Validation Mismatch

CVE-2026-122310 affects Kyverno 1.19.1 (fixed in 1.19.2) and is scored CVSS 9.9 (Critical).

Kyverno validates a Policy's context.apiCall urlPath after cleaning it, but executes the raw path. The Kubernetes client discards any fragment or query. A namespace-scoped user who can create a Policy can hide ../ segments behind # or ?: the validator sees a harmless path, while the request that actually runs reaches cluster-scoped endpoints.

Key Facts

FieldDetail
CVECVE-2026-122310
SeverityCritical (CVSS 9.9)
ProductKyverno
Affected1.19.1
Fixed in1.19.2
PrerequisiteAbility to create a namespaced Policy
Root causeValidated path differs from executed path
Published2026-11-05

Remediation

  1. Upgrade Kyverno to 1.19.2 or later. Clusters on 1.19.1 are the ones affected by this specific CVE, but the same release fixes several related flaws, so upgrade regardless of your current 1.x version.
  2. Search existing Policies for apiCall urlPath values containing # or ? together with ...
  3. Restrict who can create namespaced Policies until the upgrade is done.
  4. Review API audit logs for Kyverno-originated requests to cluster-scoped endpoints that no policy should need.

References