{"id":"CVE-2026-124440","kind":"vulnerability","aliases":["CVE-2026-124440"],"related":[],"title":"Kyverno: namespace tenants can escalate to cluster admin via apiCall","description":"Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers can create namespaced Policies whose apiCall runs as the admission-controller ServiceAccount to read other namespaces' resources and create mutating webhooks, escalating to cluster admin.","summary":"Kyverno 1.19.1 before 1.19.2 lets a namespace tenant bypass the namespace restriction on apiCall by appending malformed percent-escapes to urlPath. An attacker with a namespaced Policy can make requests as the admission-controller ServiceAccount, reading other namespaces' resources and creating mutating webhooks to reach cluster admin.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","kyverno","self-hosted"],"not_affected_if":["kyverno-not-1.19.1","no-tenant-policy-writes"],"how_to_check":"- Check the installed Kyverno version, for example with `kubectl get deploy -n kyverno -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'`\n- Confirm whether tenants can create Policies in their own namespaces, since that is the required access\n- Review existing Policies that use apiCall for unusual urlPath values containing percent-escapes","fix":"- Kyverno: move to `1.19.2` or later (the sources state 1.19.2 is the fixed version)","status":"open","published_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:48:46+00:00","updated_at":"2026-11-08T14:48:46+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-08T14:48:46Z","model":"claude-haiku-5-5","output":{"fix":"- Kyverno: move to `1.19.2` or later (the sources state 1.19.2 is the fixed version)","reach":"network","title":"Kyverno: namespace tenants can escalate to cluster admin via apiCall","impact":"high","summary":"Kyverno 1.19.1 before 1.19.2 lets a namespace tenant bypass the namespace restriction on apiCall by appending malformed percent-escapes to urlPath. An attacker with a namespaced Policy can make requests as the admission-controller ServiceAccount, reading other namespaces' resources and creating mutating webhooks to reach cluster admin.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kyverno","kubernetes","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gains cluster admin through the admission-controller ServiceAccount","analyst_note":"","how_to_check":"- Check the installed Kyverno version, for example with `kubectl get deploy -n kyverno -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'`\n- Confirm whether tenants can create Policies in their own namespaces, since that is the required access\n- Review existing Policies that use apiCall for unusual urlPath values containing percent-escapes","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["kyverno-not-1.19.1","no-tenant-policy-writes"],"who_is_affected":"Clusters running Kyverno 1.19.1 where namespace tenants can create namespaced Policies that use apiCall. Clusters on other Kyverno versions, or where only platform admins write Policies, are less exposed. The sources do not describe a default-config condition beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000793,"input_tokens":4663,"output_tokens":654,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124440':13A,16A '-2026':12A,15A '1.19.1':24B,74C '1.19.2':26B,76C 'admin':8A,71B,136C 'admiss':57B,121C 'admission-control':56B,120C 'allow':88C 'api':100C 'apical':10A,36B,84C,116C 'append':38B,103C 'attack':46B,110C 'author':79C 'bypass':31B,80C 'clamp':86C 'cluster':7A,70B,98C,135C 'cluster-scop':97C 'contain':77C 'control':58B,122C 'creat':65B,112C,130C 'cross':94C 'cross-namespac':93C 'cve':11A,14A 'escal':5A,133C 'escap':42B,107C 'host':22B 'infrastructur':17B 'issu':92C 'kubernet':18B 'kyverno':1A,19B,23B,72C 'let':27B 'make':52B 'malform':39B,104C 'mutat':66B,131C 'namespac':2A,29B,33B,49B,62B,85C,89C,95C,113C,127C 'percent':41B,106C 'percent-escap':40B,105C 'polici':50B,114C 'reach':69B 'read':60B,125C 'request':53B,101C 'resourc':63B,128C 'restrict':34B 'run':117C 'scope':99C 'self':21B 'self-host':20B 'serviceaccount':59B,123C 'tenant':3A,30B,90C 'urlpath':44B,109C 'via':9A 'vulner':81C 'webhook':67B,132C 'whose':115C","nicknames":[],"mitigations":[],"who_affected":"Clusters running Kyverno 1.19.1 where namespace tenants can create namespaced Policies that use apiCall. Clusters on other Kyverno versions, or where only platform admins write Policies, are less exposed. The sources do not describe a default-config condition beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","infrastructure","kubernetes","kyverno","selfhosted"],"campaign_type":null,"search_a":"'-124440':13A,16A '-2026':12A,15A 'admin':8A 'apical':10A 'cluster':7A 'cve':11A,14A 'escal':5A 'kyverno':1A 'namespac':2A 'tenant':3A 'via':9A","search_b":"'1.19.1':24B '1.19.2':26B 'admin':71B 'admiss':57B 'admission-control':56B 'apical':36B 'append':38B 'attack':46B 'bypass':31B 'cluster':70B 'control':58B 'creat':65B 'escap':42B 'host':22B 'infrastructur':17B 'kubernet':18B 'kyverno':19B,23B 'let':27B 'make':52B 'malform':39B 'mutat':66B 'namespac':29B,33B,49B,62B 'percent':41B 'percent-escap':40B 'polici':50B 'reach':69B 'read':60B 'request':53B 'resourc':63B 'restrict':34B 'self':21B 'self-host':20B 'serviceaccount':59B 'tenant':30B 'urlpath':44B 'webhook':67B","search_c":"'1.19.1':74C '1.19.2':76C 'admin':136C 'admiss':121C 'admission-control':120C 'allow':88C 'api':100C 'apical':84C,116C 'append':103C 'attack':110C 'author':79C 'bypass':80C 'clamp':86C 'cluster':98C,135C 'cluster-scop':97C 'contain':77C 'control':122C 'creat':112C,130C 'cross':94C 'cross-namespac':93C 'escal':133C 'escap':107C 'issu':92C 'kyverno':72C 'malform':104C 'mutat':131C 'namespac':85C,89C,95C,113C,127C 'percent':106C 'percent-escap':105C 'polici':114C 'read':125C 'request':101C 'resourc':128C 'run':117C 'scope':99C 'serviceaccount':123C 'tenant':90C 'urlpath':109C 'vulner':81C 'webhook':132C 'whose':115C","cause_entry":null,"cause_path":null,"first_public_at":"2026-10-23T07:37:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124440","severity":null,"published_at":"2026-11-08T14:18:10+00:00","modified_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102064,"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-39w8-hv5g-f73w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T07:37:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102065,"url":"https://www.vulncheck.com/advisories/kyverno-1.19.1-privilege-escalation-via-apicall-namespace-clamp-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}