CVE-2026-122304

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.17.0 through 1.19.1

Description An authorization bypass exists where namespace administrators can escape namespace confinement. This occurs because the cleanup controller initializes its context loader with a nil policy, causing security guards to read an empty namespace and fail to restrict access. An attacker can create a namespaced CleanupPolicy containing apiCall or globalReference context entries. This allows the attacker to use the cleanup controller's ServiceAccount to read Secrets across different namespaces and modify validatingwebhookconfigurations.

Recommendations Update Kyverno to version 1.19.2 or later.