CVE-2026-100706
Received Received - Intake

Kyverno Policy apiCall URL Path Traversal Vulnerability

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100706
EUVD
EUVD-2026-87679

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kyverno kyverno to 1.19.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

kyverno before version 1.19.1 has a flaw where URL-encoded path segments in Policy apiCall urlPath are not properly validated. This allows namespace tenants to bypass namespace restrictions and create objects in other namespaces using the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, which could lead to privilege escalation to cluster admin.

Impact Analysis

This vulnerability allows attackers with access to a namespace to escalate privileges to cluster admin by creating objects in other namespaces or cluster-wide. This could result in unauthorized control over the Kubernetes cluster, leading to data breaches, service disruption, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and control of sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations using vulnerable versions of kyverno may face legal penalties, reputational damage, and loss of trust due to data breaches or unauthorized access.

Mitigation Strategies

Upgrade kyverno to version 1.19.1 or later to address the improper URL validation issue. Review existing Policy apiCall configurations for percent-encoded path segments and remove any that allow unauthorized namespace access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart