CVE-2026-84200

Name of the Vulnerable Software and Affected Versions Kyverno versions v1.9.0 through v1.12.7

Description A flaw exists in the policy exception handling when a policy is set to enforce mode and combined with two PolicyExceptions. The system incorrectly allows a less restrictive exception to take precedence over a stricter one. An attacker can bypass policy enforcement, such as restrictions on hostPath volumes, by crafting a resource name that matches the broader exception pattern (e.g., *ingress*).

Recommendations Update Kyverno to version v1.13.0.