CVE-2026-124440
Received Received - Intake

Kyverno Authorization Bypass via Percent-Escape Manipulation

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers can create namespaced Policies whose apiCall runs as the admission-controller ServiceAccount to read other namespaces' resources and create mutating webhooks, escalating to cluster admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124440
EUVD
EUVD-2026-119560

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kyverno kyverno to 1.19.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in Kyverno versions 1.19.1 before 1.19.2. It allows namespace tenants to bypass namespace restrictions by appending malformed percent-escapes to URL paths. This bypasses the apiCall namespace clamp, enabling attackers to issue cross-namespace and cluster-scoped API requests as the admission-controller ServiceAccount. Attackers can read resources from other namespaces, create cluster-scoped webhooks, and ultimately gain cluster-admin privileges.

The root cause is in the apiCall.go file where the raw path is used instead of the validated path during API requests. This flaw reopens prior vulnerabilities and allows an open class of bypass payloads.

Detection Guidance

Check Kyverno version with: kubectl get deployment kyverno -n kyverno -o jsonpath='{.spec.template.spec.containers[0].image}'. If version is 1.19.1, the system is vulnerable. Inspect admission webhooks for unexpected cluster-scoped resources using: kubectl get mutatingwebhookconfigurations, kubectl get validatingwebhookconfigurations. Review Policy resources for apiCall configurations with malformed percent-escapes in urlPath.

Impact Analysis

If you use Kyverno 1.19.1, an attacker with access to create policies in their namespace could exploit this to read sensitive data across all namespaces, create malicious webhooks that modify or block workloads, and escalate privileges to full cluster admin. This could lead to data breaches, service disruptions, or complete control over your Kubernetes cluster.

Compliance Impact

This vulnerability could severely impact compliance by enabling unauthorized access to sensitive data across namespaces. GDPR requires strict data access controls and breach notification; HIPAA mandates access controls and audit logs. Exploitation could result in unauthorized data exposure, violating these regulations and potentially leading to legal penalties or loss of certification.

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. Remove any suspicious cluster-scoped webhooks or policies created by unauthorized users. Audit all namespaced Policies with apiCall configurations for malicious urlPath parameters. Restrict namespace tenant permissions to prevent policy creation until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124440. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...