CVE-2026-124441

Summary

Kyverno before 1.19.2 has an authorization bypass (CWE-863) where namespaced tenants can abuse generate rules to template arbitrary resource kinds and namespaces via variables, enabling them to create privileged resources like NetworkPolicies or RoleBindings in victim or kube-system namespaces using the background controller's elevated privileges.

Exploitability

Exploitation requires low skill and only standard Kyverno policy creation permissions within a tenant namespace, with no user interaction needed.

Blast radius

Successful exploitation allows attackers to escalate privileges across namespaces—including into kube-system—potentially compromising cluster-wide security controls, data access, or workload integrity.

Detection

Defenders should monitor for Policy resources containing generate rules with templated .kind or .namespace fields referencing external variables (e.g., {{request.object.metadata.name}} in the namespace field), especially when combined with high-privilege resource kinds like ClusterRoleBinding or NetworkPolicy; such policies, when applied and triggered, may indicate exploitation attempts.

Prioritized remediation

Upgrade to Kyverno 1.19.2 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.