CVE-2026-122311

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.16.0 through 1.19.1

Description A path traversal weakness exists where the software fails to validate path segments in the resource argument of the resource.get() and resource.post() functions. This allows namespaced Common Expression Language (CEL) policies—a declarative language used for policy enforcement—to escape their designated namespace. An attacker with permissions to create a NamespacedValidatingPolicy can use .. segments to read and write arbitrary cluster objects via the admission controller's ServiceAccount, potentially resulting in a full cluster takeover.

Recommendations Update Kyverno to version 1.19.2 or later.