CVE-2026-122310

Summary

A Kyverno policy validation flaw allows namespace-scoped users to bypass scope restrictions by embedding path traversal sequences in URL fragments or query strings, causing the system to execute cluster-scoped API calls with elevated privileges despite validating a sanitized version of the path.

Exploitability

Exploitation requires low skill and only a namespace-scoped user with permission to create Kyverno policies; no external access or complex tooling is needed.

Blast radius

Successful exploitation grants attackers cluster-admin-level access via Kyverno’s ServiceAccount, enabling full compromise of confidentiality, integrity, and availability across the entire cluster.

Detection

Monitor Kyverno policy creation events for paths containing URL-encoded or unencoded '#' or '?' characters followed by '...' segments; log entries showing Policy objects with such malformed paths may indicate attempted exploitation.

Prioritized remediation

Upgrade to Kyverno 1.19.2 or later, which validates and executes the same cleaned path instead of the raw path containing hidden traversal sequences.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.