CVE-2026-122313

Summary

Kyverno versions before 1.19.2 allow namespace-scoped tenants to escalate privileges by crafting malicious NamespacedMutatingPolicy CEL expressions that output literal cluster-scoped resources in other namespaces, bypassing namespace isolation and enabling unauthorized modifications of RoleBindings, Roles, NetworkPolicies, and ConfigMaps via the cluster-wide background controller.

Exploitability

Exploitation requires low-privilege access to create or update a NamespacedMutatingPolicy resource and knowledge of the target namespace and resource type; no user interaction or complex tooling is needed.

Blast radius

Successful exploitation allows attackers to compromise other tenants' security boundaries by modifying critical cluster resources such as RBAC bindings, network policies, and configurations across namespaces, potentially leading to full cluster compromise.

Detection

Monitor for NamespacedMutatingPolicy resources containing CEL expressions that emit literal resource references (e.g., 'target' objects with explicit namespace or name fields) and inspect Kyverno admission controller logs for mutations of cluster-scoped or cross-namespace resources initiated by namespace-scoped policies.

Prioritized remediation

Upgrade to Kyverno 1.19.2 or later, which includes namespace validation in the CEL output of NamespacedMutatingPolicy targetMatchConstraints.expression.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.