Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.
Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.
CVE-2026-44245 is a cross-site scripting (XSS) vulnerability in Kyverno prior to version 2.5.2. It arises from the use of Vue 3's v-html directive in the PropertyCard.vue component, which injects raw HTML without escaping. The vulnerability allows arbitrary HTML content from Kubernetes PolicyReport .results[].properties fields to be rendered, bypassing URL validation. This flaw is fixed in Kyverno version 2.5.2.
Kyverno versions prior to 1.16.4 and between 1.17.0-rc1 and before 1.17.2 contain a reachable assertion vulnerability in the legacy forEach mutation handler. This flaw allows any user with permission to create a Policy or ClusterPolicy to cause the cluster-wide background controller to crash repeatedly, resulting in a persistent CrashLoopBackOff. Additionally, the admission controller may drop connections and block resource operations matching the policy. The issue affects only the legacy engine; CEL-based policies are not impacted. Fixed in versions 1.16.4 and 1.17.2.
Kyverno versions prior to 1.16.4 and between 1.17.0-rc1 and before 1.17.2-rc1 contain a vulnerability in the apiCall feature of ClusterPolicy. This feature automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests without validating the destination URL, which can be attacker-controlled. Because the admission controller's ServiceAccount has permissions to patch webhook configurations, an attacker who obtains this token can achieve full cluster compromise. The issue is fixed in versions 1.16.4 and 1.17.2-rc1.
CVE-2026-41068 is an incorrect authorization vulnerability in Kyverno prior to version 1.17.2. It allows a namespace administrator to bypass RBAC restrictions in multi-tenant Kubernetes clusters by reading ConfigMaps from any namespace without proper validation. This vulnerability arises because the ConfigMap context loader accepts any namespace in the configMap.namespace field without validation, similar to a previously fixed issue in the apiCall context. A fix is available in Kyverno version 1.17.2.
CVE-2026-40868 is a high-severity vulnerability in Kyverno prior to version 1.16.4. The issue involves insecure storage and transmission of sensitive information where the apiCall servicecall helper implicitly injects the Kyverno controller serviceaccount token in Authorization headers when not explicitly set by policy. Because the URL for the apiCall is policy-controlled, this can lead to token leakage to attacker-controlled endpoints in ClusterPolicy and global context usage. Namespaced policies are not affected due to existing restrictions. The vulnerability is fixed in Kyverno version 1.16.4.