{"id":"CVE-2026-122320","kind":"vulnerability","aliases":["CVE-2026-122320"],"related":[],"title":"Kyverno: namespaced policy authors can copy ConfigMaps across namespaces","description":"Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating generate.clone or cloneList namespace values. Attackers can annotate a triggering ConfigMap so the background-controller copies a victim namespace's sensitive ConfigMap into the attacker's namespace, enabling cross-tenant data disclosure.","summary":"Kyverno before 1.19.2 lets a user who can write namespaced Policy objects template generate.clone or cloneList namespace values to reach other namespaces. An attacker can make the background controller copy a victim namespace's sensitive ConfigMap into their own namespace, exposing that data.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","kyverno","multi-tenant-clusters"],"not_affected_if":["kyverno-1.19.2-or-later","no-namespaced-policy-authors","single-tenant-cluster"],"how_to_check":"- Check the Kyverno version running in the cluster, for example with `kubectl get deploy -n kyverno -o wide` and the image tag.\n- Review which users can create or edit Policy resources in namespaces, and whether any policy uses generate.clone or cloneList.","fix":"- Kyverno: move to `1.19.2` or later.","status":"open","published_at":"2026-11-05T03:17:24+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","triaged_at":"2026-11-05T03:33:18+00:00","updated_at":"2026-11-05T03:33:18+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T03:33:18Z","model":"claude-haiku-5-5","output":{"fix":"- Kyverno: move to `1.19.2` or later.","reach":"network","title":"Kyverno: namespaced policy authors can copy ConfigMaps across namespaces","impact":"medium","summary":"Kyverno before 1.19.2 lets a user who can write namespaced Policy objects template generate.clone or cloneList namespace values to reach other namespaces. An attacker can make the background controller copy a victim namespace's sensitive ConfigMap into their own namespace, exposing that data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","kyverno","multi-tenant-clusters"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"cross-namespace ConfigMap data is copied and readable by attacker","analyst_note":"","how_to_check":"- Check the Kyverno version running in the cluster, for example with `kubectl get deploy -n kyverno -o wide` and the image tag.\n- Review which users can create or edit Policy resources in namespaces, and whether any policy uses generate.clone or cloneList.","plain_action":"","needs_analyst":false,"not_affected_if":["kyverno-1.19.2-or-later","single-tenant-cluster","no-namespaced-policy-authors"],"who_is_affected":"Clusters running Kyverno before 1.19.2 where some users can create namespaced Policy objects that use generate clone or cloneList. Clusters where only administrators write policies, or where Kyverno is not installed, are much less exposed. The sources do not say whether the default install is affected beyond the version range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4301,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122320':12A,15A '-2026':11A,14A '1.19.2':25B,68C 'across':8A 'allow':75C 'annot':94C 'attack':46B,92C,112C 'author':4A,72C,78C 'background':50B,101C 'background-control':100C 'clonelist':38B,89C 'cluster':22B 'configmap':7A,58B,97C,109C 'contain':69C 'control':51B,102C 'copi':6A,52B,103C 'cross':117C 'cross-ten':116C 'cve':10A,13A 'data':65B,119C 'disclosur':120C 'enabl':115C 'expos':63B 'generate.clone':36B,87C 'infrastructur':16B 'kubernet':17B 'kyverno':1A,18B,23B,66C 'let':26B 'make':48B 'miss':71C 'multi':20B 'multi-tenant-clust':19B 'namespac':2A,9A,32B,39B,44B,55B,62B,76C,84C,90C,106C,114C 'object':34B 'polici':3A,33B,77C 'reach':42B 'read':80C 'resourc':81C 'sensit':57B,108C 'templat':35B,86C 'tenant':21B,118C 'trigger':96C 'user':28B 'valu':40B,91C 'victim':54B,105C 'vulner':73C 'write':31B","nicknames":[],"mitigations":[],"who_affected":"Clusters running Kyverno before 1.19.2 where some users can create namespaced Policy objects that use generate clone or cloneList. Clusters where only administrators write policies, or where Kyverno is not installed, are much less exposed. The sources do not say whether the default install is affected beyond the version range.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","kubernetes","kyverno","multitenantclusters"],"campaign_type":null,"first_public_at":"2026-10-21T15:58:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122320","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122320","severity":null,"published_at":"2026-11-05T03:17:24+00:00","modified_at":"2026-11-05T03:17:24+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","fetched_at":"2026-11-05T03:31:42+00:00","note":null}],"documents":[{"id":72720,"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-493q-9xvg-9xf3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T15:58:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":72721,"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.2-cross-namespace-resource-read-via-generate-clone","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}