CVE-2026-100706

Summary

The flaw allows namespace tenants to bypass per-namespace restrictions and create objects in other namespaces, leading to potential privilege escalation to cluster admin.

Exploitability

Exploitation is relatively straightforward given the ability to use percent-encoded directory traversal sequences, requiring attackers to have access to the affected kyverno version.

Blast radius

If exploited, the impact could be severe, as it allows attackers to create cluster-wide objects, significantly increasing the attack surface.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to kyverno 1.19.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.