CVE-2026-124441 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kyverno before 1.19.2 lets a user in one namespace template a generate rule so the privileged background controller creates resources of any kind in any namespace. An attacker can use this to write NetworkPolicies or RoleBindings into victim or kube-system namespaces.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clusters running Kyverno before 1.19.2 where namespaced users can create policies with generate rules. Clusters where only cluster admins write Kyverno policies are less exposed. The sources do not describe further conditions.
Not affected if kyverno-1.19.2-or-later, no-untrusted-namespace-tenants
Who cares kubernetes, kyverno
kubectl get deploy -A -o wide | grep kyverno and compare against 1.19.2.1.19.2 or later.Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged background-controller to write NetworkPolicies or RoleBindings into victim or kube-system namespaces.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.