CVE-2026-122312
Received Received - Intake

Kyverno Namespace Isolation Bypass via APICall Fetch

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description
Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122312
EUVD
EUVD-2026-117223

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kyverno kyverno 1.19.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-122312 is a namespace isolation bypass in Kyverno, a Kubernetes policy engine. It occurs in the APICall Fetch() function where path validation incorrectly treats query strings as part of the path due to how path.Clean handles the '?' character. This allows attackers with permission to create namespaced policies to craft URLs like /api/v1/nodes?x=/namespaces/default/ that pass validation but execute as cluster-scoped requests, bypassing namespace restrictions.

Detection Guidance

To detect this vulnerability, check Kyverno version with 'kyverno version' command. If running versions 1.19.1 through 1.19.2 (excluding 1.19.2), the system is vulnerable. Review Kyverno policy definitions for suspicious API call URLs containing query parameters like '/api/v1/nodes?x=/namespaces/default/' that bypass namespace validation.

Impact Analysis

An attacker with permission to create namespaced Kyverno policies could exploit this to read sensitive resources like nodes, cluster roles, or secrets across namespaces. This breaks tenant isolation, allowing unauthorized access to cluster-scoped data or resources in other namespaces, potentially leading to data breaches or privilege escalation.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict data isolation and access controls, such as GDPR's data protection principles or HIPAA's access controls for protected health information. Unauthorized cross-namespace access risks exposing sensitive data, leading to regulatory penalties and loss of trust.

Mitigation Strategies

Immediately upgrade Kyverno to version 1.19.2 or later using your package manager. If upgrading isn't possible, restrict users from creating namespaced policies until patched. Review existing policies for malicious API call patterns and remove any that contain query string bypass attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122312. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...