CVE-2026-122310 · Package
NO FIX YET · SEE WHAT TO DO
Kyverno checks a Policy's context.apiCall urlPath after cleaning it, but then runs the raw path, which drops anything after a # or ?. A user who can create a Policy in their namespace can hide ../ segments there to reach cluster-scoped endpoints using Kyverno's ServiceAccount, which gives cluster admin.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Kyverno from 1.19.1 before 1.19.2 where some users can create Policies in their own namespace. The data path is a Policy's context.apiCall urlPath, so the exposure depends on who can write Policies. Clusters where Policy creation is limited to trusted administrators are lower risk, but the sources do not say how common that setup is.
Not affected if kyverno-1.19.2-or-later, kyverno-below-1.19.1
Who cares kubernetes, kyverno
kubectl get deploy -n kyverno -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'1.19.2 or later (from 1.19.1 onward, before 1.19.2 is affected)Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # or ? to reach cluster-scoped endpoints with Kyverno's ServiceAccount, gaining cluster admin.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.