CVE-2026-122310
Received Received - Intake

Kyverno Policy Context Validation Bypass via Path Manipulation

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description
Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # or ? to reach cluster-scoped endpoints with Kyverno's ServiceAccount, gaining cluster admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122310
EUVD
EUVD-2026-117221

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kyverno kyverno 1.19.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kyverno versions 1.19.1 before 1.19.2 have a flaw where the system validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path. Attackers with namespace-scoped permissions can hide directory traversal segments (../) behind URL fragments (#) or queries (?), bypassing namespace restrictions and targeting cluster-scoped endpoints with Kyverno's privileged ServiceAccount. This grants cluster admin access.

Detection Guidance

Check Kyverno version with 'kyverno version' command. Inspect Policies for malicious urlPath values containing # or ? followed by ../ segments. Review admission controller logs for unexpected requests to cluster-scoped endpoints.

Impact Analysis

An attacker with create permissions on policies.kyverno.io in their namespace can exploit this to create privileged objects like MutatingWebhookConfiguration or ValidatingWebhookConfiguration, effectively gaining full cluster admin privileges. This allows unauthorized access to sensitive data and control over the Kubernetes cluster.

Compliance Impact

This vulnerability could lead to unauthorized access and control over sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). Unauthorized privilege escalation risks data breaches and non-compliance with regulatory controls.

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. Remove unnecessary permissions for creating Policies in namespaces. Monitor for unauthorized creation of cluster-scoped objects like webhook configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...