CVE-2026-122320 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kyverno before 1.19.2 lets a user who can write namespaced Policy objects template generate.clone or cloneList namespace values to reach other namespaces. An attacker can make the background controller copy a victim namespace's sensitive ConfigMap into their own namespace, exposing that data.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Kyverno before 1.19.2 where some users can create namespaced Policy objects that use generate clone or cloneList. Clusters where only administrators write policies, or where Kyverno is not installed, are much less exposed. The sources do not say whether the default install is affected beyond the version range.
Not affected if kyverno-1.19.2-or-later, no-namespaced-policy-authors, single-tenant-cluster
Who cares kubernetes, kyverno, multi-tenant-clusters
kubectl get deploy -n kyverno -o wide and the image tag.1.19.2 or later.Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating generate.clone or cloneList namespace values. Attackers can annotate a triggering ConfigMap so the background-controller copies a victim namespace's sensitive ConfigMap into the attacker's namespace, enabling cross-tenant data disclosure.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.