CVE-2026-122303 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kyverno versions 1.17.0 through 1.19.1 let a user in one namespace abuse NamespacedMutatingPolicy mutate-existing rules to make the background controller overwrite resources in other namespaces. An attacker can overwrite Secrets, Deployments or policies across the cluster.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Kyverno from 1.17.0 before 1.19.2 that let namespace tenants create NamespacedMutatingPolicy resources with mutate-existing rules. Single-tenant clusters, or clusters where only cluster admins can create these policies, are much less exposed.
Not affected if kyverno-1.19.2-or-later, kyverno-below-1.17.0, single-tenant-cluster
Who cares kubernetes, kyverno, multi-tenant
kubectl get deploy -n kyverno -o wide or the image tag on the Kyverno controller.1.19.2 or later (affected range is 1.17.0 before 1.19.2).Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.