Kyverno versions prior to 1.19.1 have a namespace isolation bypass vulnerability in the apiCall context entry of namespaced Policy resources. This occurs due to inconsistent path interpretation between validation and execution, allowing a low-privilege tenant to use percent-encoded dot-segments in the urlPath to bypass namespace checks. Exploitation enables reading resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials.