Kyverno Authorization Bypass via Templated Generate Rules

Executive Summary

CVE-2026-124441 is an authorization bypass vulnerability in Kyverno versions before 1.19.2. It allows namespaced tenants to generate any Kubernetes resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger a ConfigMap in their own namespace, causing the privileged background-controller to write privileged resources like NetworkPolicies or RoleBindings into victim namespaces or the kube-system namespace.

Useful 0 Not Useful 0

Detection Guidance

Check Kyverno version with 'kyverno version' command. If version is below 1.19.2, the system is vulnerable. Inspect Kyverno policies for generate rules using variables in kind or namespace fields, such as '{{request.object.metadata.labels.attackKind}}'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass authorization checks and create unauthorized resources in other namespaces, including critical ones like NetworkPolicy or RoleBinding. Attackers can modify NetworkPolicy in a victim's namespace to allow unauthorized access or exfiltration, bypassing RBAC restrictions due to the controller's elevated privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive resources, potentially violating data protection requirements under GDPR and HIPAA. Unauthorized creation of NetworkPolicies or RoleBindings in victim namespaces may enable data exfiltration or privilege escalation, compromising confidentiality and integrity of regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. Review and remove any Kyverno policies containing variable-based generate rules. Implement stricter validation for high-risk resource kinds and ensure proper identity checks in authorization logic.

Useful 0 Not Useful 0