CVE-2026-122303

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.17.0 through 1.19.1

Description An authorization bypass allows namespace tenants to overwrite resources in other namespaces. This occurs via the NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. An attacker can return a CEL (Common Expression Language) map literal to fabricate a target with a chosen metadata.namespace, which leads the privileged background controller to overwrite Secrets, Deployments, or policies across the cluster.

Recommendations Update to version 1.19.2.