CVE-2026-84200
Received Received - Intake

Kyverno Policy Exception Handling Bypass Vulnerability

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84200
EUVD
EUVD-2026-69035

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kyverno kyverno 1.13.0
kyverno kyverno From 1.9.0 (inc) to 1.13.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84200 is a policy bypass vulnerability in Kyverno versions v1.9.0 through v1.12.7. When a security policy in enforce mode uses two PolicyExceptions, the less restrictive exception overrides the more restrictive one. This allows attackers to bypass intended restrictions by crafting resource names matching the second exception's pattern, such as '*ingress*'.

Detection Guidance

Check Kyverno version with kubectl get pods -n kyverno -l app=kyverno -o jsonpath='{.items[0].metadata.labels.version}' to see if it falls within v1.9.0 to v1.12.7. Review PolicyException resources for conflicting rules where a less restrictive exception may override a stricter one.

Impact Analysis

This vulnerability allows unauthorized access or actions that security policies were designed to prevent. For example, it could let attackers bypass policies blocking hostPath volumes, potentially leading to container escapes or privilege escalation. The flaw requires low privileges and is exploitable with minimal access.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR or HIPAA by allowing unauthorized access to sensitive data or systems. Bypassing security policies may result in violations of data protection requirements, potentially leading to legal penalties or loss of certification.

Mitigation Strategies

Upgrade Kyverno to version v1.13.0 or later immediately. Review and remove any conflicting PolicyExceptions that could allow bypasses. Audit existing policies and exceptions for potential misconfigurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84200. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart