{"id":"CVE-2026-122311","kind":"vulnerability","aliases":["CVE-2026-122311"],"related":[],"title":"Kyverno: namespaced policies can read and write cluster objects outside their namespace","description":"Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.","summary":"Kyverno versions from 1.16.0 before 1.19.2 do not validate path segments in the resource argument of resource.get() and resource.post() in CEL policies. A tenant allowed to create a NamespacedValidatingPolicy can use '..' segments to read and write arbitrary cluster objects through the admission controller's ServiceAccount, which the sources say leads to cluster takeover.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","kyverno","multi-tenant-clusters"],"not_affected_if":["kyverno-1.19.2-or-later","kyverno-below-1.16.0","no-tenant-policy-creation"],"how_to_check":"- Check the installed Kyverno version (for example with `kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'`) and see whether it falls in `1.16.0` to before `1.19.2`.\n- List who can create NamespacedValidatingPolicy resources, for example with `kubectl auth can-i create namespacedvalidatingpolicies --namespace <tenant-ns>`.","fix":"- Kyverno: move to `1.19.2` or later (the sources state this as the fixed version).","status":"open","published_at":"2026-11-05T03:17:23+00:00","first_seen_at":"2026-11-05T03:31:41+00:00","triaged_at":"2026-11-05T03:33:05+00:00","updated_at":"2026-11-05T03:33:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T03:33:05Z","model":"claude-haiku-5-5","output":{"fix":"- Kyverno: move to `1.19.2` or later (the sources state this as the fixed version).","reach":"network","title":"Kyverno: namespaced policies can read and write cluster objects outside their namespace","impact":"high","summary":"Kyverno versions from 1.16.0 before 1.19.2 do not validate path segments in the resource argument of resource.get() and resource.post() in CEL policies. A tenant allowed to create a NamespacedValidatingPolicy can use '..' segments to read and write arbitrary cluster objects through the admission controller's ServiceAccount, which the sources say leads to cluster takeover.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","kyverno","multi-tenant-clusters"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"cluster objects read and written with admission controller privileges, leading to takeover","analyst_note":"Confirm the affected range and whether non-namespaced policy types are also affected using the vendor advisory on github.com linked from the NVD entry.","how_to_check":"- Check the installed Kyverno version (for example with `kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'`) and see whether it falls in `1.16.0` to before `1.19.2`.\n- List who can create NamespacedValidatingPolicy resources, for example with `kubectl auth can-i create namespacedvalidatingpolicies --namespace <tenant-ns>`.","plain_action":"","needs_analyst":true,"not_affected_if":["kyverno-below-1.16.0","kyverno-1.19.2-or-later","no-tenant-policy-creation"],"who_is_affected":"Clusters running Kyverno from 1.16.0 before 1.19.2 where tenants can create NamespacedValidatingPolicy resources. The sources do not say whether ClusterValidatingPolicy or default installs are affected, so the exposure surface beyond namespaced policies is unknown. Teams that run Kyverno only with trusted administrators and no tenant policy creation are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000826,"input_tokens":4305,"output_tokens":790,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-122311':15A,18A '-2026':14A,17A '1.16.0':29B,81C '1.19.2':31B,83C 'admiss':67B,123C 'allow':50B,97C 'arbitrari':62B,118C 'argument':40B,92C 'cel':46B,99C 'cluster':8A,25B,63B,77B,119C,129C 'control':68B,124C 'creat':52B,108C 'cve':13A,16A 'escap':102C 'fail':84C 'infrastructur':19B 'insert':112C 'kubernet':20B 'kyverno':1A,21B,26B,79C 'lead':75B,127C 'multi':23B 'multi-tenant-clust':22B 'namespac':2A,12A,98C,104C 'namespacedvalidatingpolici':54B,110C 'object':9A,64B,120C 'outsid':10A 'path':35B,87C 'polici':3A,47B,100C 'read':5A,59B,115C 'resourc':39B,91C 'resource.get':42B,94C 'resource.post':44B,96C 'say':74B 'segment':36B,57B,88C,113C 'serviceaccount':70B,126C 'sourc':73B 'takeov':78B,130C 'tenant':24B,49B,105C 'use':56B,121C 'valid':34B,86C 'version':27B 'write':7A,61B,117C","nicknames":[],"mitigations":[],"who_affected":"Clusters running Kyverno from 1.16.0 before 1.19.2 where tenants can create NamespacedValidatingPolicy resources. The sources do not say whether ClusterValidatingPolicy or default installs are affected, so the exposure surface beyond namespaced policies is unknown. Teams that run Kyverno only with trusted administrators and no tenant policy creation are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","infrastructure","kubernetes","kyverno","multitenantclusters"],"campaign_type":null,"first_public_at":"2026-10-21T15:46:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122311","severity":null,"published_at":"2026-11-05T03:17:23+00:00","modified_at":"2026-11-05T03:17:23+00:00","first_seen_at":"2026-11-05T03:31:41+00:00","fetched_at":"2026-11-05T03:31:41+00:00","note":null}],"documents":[{"id":72700,"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T15:46:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":72701,"url":"https://www.vulncheck.com/advisories/kyverno-1.16.0-before-1.19.2-path-traversal-in-namespaced-cel-policies-via-resource-argument","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}