CVE-2026-122304

Summary

Kyverno versions before 1.19.2 contain an authorization bypass (CWE-863) where namespace admins can escape namespace confinement by exploiting the cleanup controller's improper handling of nil policies, allowing them to read cross-namespace Secrets and modify validatingwebhookconfigurations.

Exploitability

Exploitation requires low-privilege access as a namespace admin with permission to create CleanupPolicy resources, and is straightforward given public exploit references.

Blast radius

Successful exploitation enables full compromise of cross-namespace Secrets and webhook configurations, potentially affecting cluster-wide security controls and data confidentiality.

Detection

Defenders should monitor for creation of CleanupPolicy resources with apiCall or globalReference context entries in non-admin namespaces; such policies are unexpected and may indicate abuse of the cleanup controller's elevated privileges.

Prioritized remediation

Upgrade to Kyverno 1.19.2 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.