#Kyverno
All CosmicBytez Labs articles tagged #Kyverno, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-122302: Kyverno Generate Rules Enable Privilege Escalation Beyond RBAC
Kyverno before 1.19.2 checks the controller's permissions, not the author's, on generate rules, letting namespace admins exceed RBAC (CVSS 9.8).
- Security
CVE-2026-122303: Kyverno NamespacedMutatingPolicy Overwrites Resources in Other Namespaces
Kyverno 1.17.0 to before 1.19.2 lets namespace tenants overwrite other namespaces' resources via mutate-existing CEL expressions (CVSS 9.9).
- Security
CVE-2026-122304: Kyverno CleanupPolicy Context Loader Lets Namespace Admins Escape Confinement
Kyverno 1.17.0 to before 1.19.2 builds the cleanup controller's context loader with a nil policy, so namespaced CleanupPolicies escape confinement (CVSS 9.9).
- Security
CVE-2026-122310: Kyverno apiCall urlPath Validation Bypass Reaches Cluster-Scoped Endpoints
Kyverno 1.19.1 validates a cleaned urlPath but runs the raw one; hiding ../ behind # or ? lets namespace users reach cluster endpoints (CVSS 9.9).
- Security
CVE-2026-122311: Kyverno CEL resource.get() Path Traversal Escapes Namespace
Kyverno 1.16.0 to before 1.19.2 does not validate path segments in resource.get() and resource.post(), letting tenants reach cluster resources (CVSS 9.9).
- Security
CVE-2026-54523: Kyverno CEL Generator Bypasses Namespace Isolation
Critical Kyverno flaw lets a namespace-scoped policy invoke generator.apply() with an arbitrary namespace, creating RoleBindings in kube-system.