CVE-2026-122302

Summary

Kyverno before 1.19.2 has a privilege escalation flaw where namespace admins can bypass RBAC by creating generate rules that trigger cluster-wide resource creation via the controller's elevated permissions instead of the author's.

Exploitability

Exploitation requires only namespace-admin-level access and knowledge of Kyverno's generate rule syntax; no external dependencies or complex setup.

Blast radius

Successful exploitation allows attackers to create or clone resources cluster-wide—including in other namespaces or at cluster scope—potentially compromising confidentiality, integrity, and availability across the entire cluster.

Detection

Defenders should monitor for Policy resources with generate rules that reference cluster-scoped kinds or target namespaces beyond the author's namespace; such policies are not expected to be creatable by namespace admins and indicate potential abuse.

Prioritized remediation

Upgrade to Kyverno 1.19.2 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.