SECURITYCRITICALCVE-2026-122311

CVE-2026-122311: Kyverno CEL resource.get() Path Traversal Escapes Namespace

Kyverno 1.16.0 to before 1.19.2 does not validate path segments in resource.get() and resource.post(), letting tenants reach cluster resources (CVSS 9.9).

Dylan H.

Security Team

November 5, 2026
2 min read
CVE-2026-122311: Kyverno CEL resource.get() Path Traversal Escapes Namespace

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Kyverno 1.16.0 up to, but not including, 1.19.2

CVE-2026-122311: Kyverno Path Traversal in CEL Resource Functions

CVE-2026-122311 affects Kyverno from 1.16.0 up to (not including) 1.19.2 and is scored CVSS 9.9 (Critical).

Kyverno fails to validate the path segments in the resource argument of the CEL functions resource.get() and resource.post(). A tenant who can create a NamespacedValidatingPolicy can insert .. segments and escape the namespace, reading and writing arbitrary cluster resources.

Key Facts

FieldDetail
CVECVE-2026-122311
SeverityCritical (CVSS 9.9)
ProductKyverno
Affected1.16.0 up to, but not including, 1.19.2
Fixed in1.19.2
PrerequisiteAbility to create a NamespacedValidatingPolicy
ImpactRead and write of arbitrary cluster resources
Published2026-11-05

Why It Matters

A validating policy is normally expected to be a read-only guard. Here, a namespaced policy author can use the CEL helpers to issue API requests with traversal sequences and reach cluster-scoped endpoints or other namespaces. In multi-tenant clusters this is a path from namespace-level access to cluster-wide control.

Remediation

  1. Upgrade Kyverno to 1.19.2 or later.
  2. Limit who can create NamespacedValidatingPolicy objects until patched.
  3. Search existing policies for resource.get() or resource.post() calls whose arguments contain ...
  4. Review Kubernetes API audit logs for requests originating from the Kyverno service account that touch unexpected namespaces or cluster-scoped resources.

References