CVE-2026-122303

Summary

Kyverno versions before 1.19.2 contain an authorization bypass (CWE-862) in NamespacedMutatingPolicy with mutate-existing targetMatchConstraints.expression, allowing namespace-scoped users to forge target resource namespaces via CEL map literals, enabling cross-namespace or cluster-wide overwrites of sensitive resources like Secrets and Deployments.

Exploitability

Exploitation requires low privilege (PR:L) and no user interaction (UI:N), but is limited to attackers with access to create or modify NamespacedMutatingPolicies in their own namespace.

Blast radius

Successful exploitation allows cluster-wide resource overwrites, potentially compromising confidentiality, integrity, and availability across the entire Kubernetes cluster.

Detection

Monitor for NamespacedMutatingPolicy resources containing mutate-existing targetMatchConstraints.expression that return a CEL map literal with a fabricated metadata.namespace field; such policies may indicate an attempt to bypass namespace isolation.

Prioritized remediation

Upgrade to Kyverno 1.19.2 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.