CVE-2026-122311

Summary

Kyverno versions before 1.19.2 allow authenticated users with NamespacedValidatingPolicy permissions to escape their namespace by injecting '..' path segments in resource.get() and resource.post() calls, enabling unauthorized read/write access to cluster-scoped resources via the admission controller's ServiceAccount.

Exploitability

Exploitation requires low-privilege access to create or modify NamespacedValidatingPolicies and knowledge of valid CEL policy syntax; no external network access needed.

Blast radius

Successful exploitation grants full cluster control through the admission controller’s high-privileged ServiceAccount, enabling lateral movement, data exfiltration, and persistent backdoor deployment.

Detection

Monitor for CEL policy objects containing '..' in resource.get() or resource.post() path arguments; inspect admission webhook logs for unexpected cluster-scoped resource access by namespaced policies.

Prioritized remediation

Upgrade Kyverno to version 1.19.2 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.