CVE-2026-122302 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kyverno before 1.19.2 lets a namespace admin create a namespaced Policy with generate rules that target other namespaces or cluster-scoped kinds. The background controller then creates or clones those resources cluster-wide, using its own permissions rather than the author's.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Kyverno before 1.19.2 are exposed, since the background controller carries its own permissions when processing generate rules. Anyone who can create namespaced Policies in a namespace can reach cluster-wide resources through this path. Clusters without Kyverno, or where only trusted operators can write policies, have less exposure.
Not affected if kyverno-not-installed, no-generate-rules-in-use
Who cares kubernetes, kyverno, policy-as-code
kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'kubectl get policies -A -o yaml | grep -n generate1.19.2 or later (the sources state the fix is in versions before 1.19.2 being vulnerable)Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.