Kyverno versions from 1.11.0 up to but not including 1.19.2 contain an unbounded decompression vulnerability in the FetchSignatureBlob function. This flaw allows attackers who control registry referrers or signatures to supply highly compressed gzip layers that decompress beyond the configured maxPayloadSize, leading to memory exhaustion. The resulting out-of-memory (OOM) condition can cause the admission controller to crash, resulting in denial of service.
Kyverno versions before 1.19.2 have a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces. This occurs via templating generate.clone or cloneList namespace values, enabling an attacker to cause the background-controller to copy sensitive ConfigMaps from a victim namespace into the attacker's namespace, resulting in cross-tenant data disclosure.
Kyverno versions prior to 1.19.2 contain an authentication bypass vulnerability in the matchCertificateData function. This flaw allows attackers with a leaf certificate from a configured private trust root to bypass subject and subjectRegExp checks if the signing certificate lacks a Subject Alternative Name (SAN). By omitting the SAN and setting the expected Fulcio issuer OID, attackers can sign malicious images that are admitted despite signer pinning. The issue is fixed in version 1.19.2.
Kyverno versions from 1.17.0 up to but not including 1.19.2 have a missing authorization vulnerability in the mutate-existing background processor. This flaw allows namespaced tenants to modify resources outside their own namespace by creating a NamespacedMutatingPolicy targeting Namespace objects or resources in other namespaces. Exploitation can lead to cluster-wide removal of Pod Security labels by the background-controller ServiceAccount.
Kyverno versions before 1.19.2 have an unchecked type assertion vulnerability in the buildStatementMap function. This flaw allows unauthenticated attackers to crash the policy engine by submitting crafted attestation statements. Specifically, attackers can push an OCI referrer manifest containing a non-string type field, which can bypass image verification when failurePolicy is set to Ignore or cause the reports-controller to enter a crash loop.
Kyverno versions before 1.19.2 have an unchecked type assertion vulnerability in the variable-substitution engine. This flaw allows users who can submit resources to cause the policy engine to crash by submitting resources with non-string fields referenced in shallow substitutions. The resulting panic leads to webhook denial of service and potential policy bypass when failurePolicy is set to Ignore. The issue is fixed in version 1.19.2.
Kyverno versions from 1.17.0 up to but not including 1.19.2 contain a critical privilege escalation vulnerability. This flaw allows namespace-scoped tenants to modify resources in other namespaces by exploiting a lack of namespace checks in the NamespacedMutatingPolicy targetMatchConstraints.expression CEL output. Attackers can manipulate cluster-wide background controllers to alter RoleBindings, Roles, NetworkPolicies, and ConfigMaps in other namespaces. The vulnerability is fixed in version 1.19.2.
CVE-2026-122312 is a high-severity vulnerability in Kyverno versions 1.19.1 up to but not including 1.19.2. It involves an improper privilege management issue where a namespace isolation bypass occurs due to incorrect handling of the '?' character in URL paths. This allows users with permission to create namespaced policies to craft URLs that bypass namespace restrictions and access cluster-scoped resources outside their namespace.
Kyverno versions from 1.16.0 up to but not including 1.19.2 contain a path traversal vulnerability in the resource.get() and resource.post() functions. This flaw allows namespaced CEL policies to escape their namespace by inserting '..' segments in the resource argument, enabling unauthorized read and write access to arbitrary cluster objects via the admission controller's ServiceAccount. This can lead to a complete cluster takeover. The issue is fixed in version 1.19.2.
CVE-2026-122310 is a critical vulnerability in Kyverno versions 1.19.1 up to but not including 1.19.2. It arises from a discrepancy between how Kyverno validates and executes the Policy's context.apiCall urlPath, allowing a namespace-scoped user with Policy creation rights to exploit URL fragments or queries to access cluster-scoped endpoints with elevated privileges. This can lead to cluster admin access.
Kyverno versions prior to 1.19.2 contain a denial of service vulnerability where namespace-scoped policy authors can cause uncontrolled resource consumption. By submitting CEL expressions with nested map comprehensions over large ConfigMap fields, attackers can exhaust CPU and memory resources, potentially causing Kyverno pods to be OOM-killed and blocking cluster-wide admission.
Kyverno versions before 1.19.2 contain an authorization bypass vulnerability in the Generation Handler. This flaw allows users with create or update permissions to spoof internal labels and trigger synchronized generate policies. Exploitation can enable attackers to label a ConfigMap as managed by Kyverno with crafted labels, potentially cloning sensitive Secrets from restricted namespaces into their own namespace.
Kyverno versions before 1.19.2 have a policy bypass vulnerability in the admissionpolicygenerator controller. This flaw allows users with namespaced create rights on PolicyExceptions to inject negated matchConditions into generated ValidatingAdmissionPolicies, bypassing cluster-wide enforcement. The vulnerability arises because PolicyExceptions are folded into generated policies without respecting certain gates such as --enablePolicyException, --exceptionNamespace, and policy kind gates. The issue is fixed in Kyverno version 1.19.2.
Kyverno versions before 1.19.2 contain a denial of service vulnerability due to inefficient algorithmic complexity. This flaw allows namespaced policy authors to exhaust the admission controller's CPU by submitting specially crafted wildcard patterns in policies. The vulnerability causes cluster-wide webhook timeouts that block resource operations.
Kyverno versions before 1.19.2 contain a denial of service vulnerability caused by an infinite loop in the substituteVariablesIfAny function. This flaw allows low-privileged users to create resources with self-referential variable templates in annotations, triggering unbounded substitution loops. The resulting infinite loop exhausts CPU and memory resources, causing the admission webhook to hang and blocking cluster-wide admission processes.
Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace administrators to escape their namespace confinement due to the cleanup controller using a nil policy context loader. Exploiting this, attackers can create namespaced CleanupPolicy resources with specific context entries to read Secrets across namespaces and modify validating webhook configurations using the cleanup controller's ServiceAccount.
Kyverno versions from 1.17.0 up to but not including 1.19.2 contain an authorization bypass vulnerability. This flaw allows namespace tenants to overwrite resources in other namespaces by exploiting the NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. An attacker can craft a CEL map literal that fabricates a target with an attacker-chosen metadata.namespace, enabling the privileged background controller to overwrite critical cluster-wide resources such as Secrets, Deployments, or policies. The vulnerability is rated critical with a CVSS 4.0 score of 9.4 and has been fixed in version 1.19.2.
Kyverno versions before 1.19.2 have a privilege escalation vulnerability that allows namespace administrators to create resources beyond their assigned RBAC permissions. This occurs because generate-rule admission checks validate the controller's permissions rather than the resource author's. As a result, attackers can craft namespaced Policies with generate rules targeting other namespaces or cluster-scoped resources, causing the background controller to create or clone resources cluster-wide.