---
id: "CVE-2026-122311"
kind: "vulnerability"
aliases: ["CVE-2026-122311"]
title: "Kyverno: namespaced policies can read and write cluster objects outside their namespace"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kubernetes", "kyverno", "multi-tenant-clusters"]
not_affected_if: ["kyverno-1.19.2-or-later", "kyverno-below-1.16.0", "no-tenant-policy-creation"]
published_at: "2026-11-05T03:17:23+00:00"
first_seen_at: "2026-11-05T03:31:41+00:00"
updated_at: "2026-11-05T03:33:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122311", "first_seen_at": "2026-11-05T03:31:41+00:00"}]
exploit_sources: []
---

# Kyverno: namespaced policies can read and write cluster objects outside their namespace

Kyverno versions from 1.16.0 before 1.19.2 do not validate path segments in the resource argument of resource.get() and resource.post() in CEL policies. A tenant allowed to create a NamespacedValidatingPolicy can use '..' segments to read and write arbitrary cluster objects through the admission controller's ServiceAccount, which the sources say leads to cluster takeover.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kyverno version (for example with `kubectl get deployment -n kyverno kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].image}'`) and see whether it falls in `1.16.0` to before `1.19.2`.
- List who can create NamespacedValidatingPolicy resources, for example with `kubectl auth can-i create namespacedvalidatingpolicies --namespace <tenant-ns>`.

## Fix

- Kyverno: move to `1.19.2` or later (the sources state this as the fixed version).

## Timeline

- 2026-11-05T03:31:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122311

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/kyverno-1.16.0-before-1.19.2-path-traversal-in-namespaced-cel-policies-via-resource-argument

## From the sources

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_