CVE-2026-122313

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.17.0 through 1.19.1

Description Namespace-scoped tenants can achieve privilege escalation by modifying resources in other namespaces. This occurs because the targetMatchConstraints.expression within the NamespacedMutatingPolicy lacks proper namespace checks in its Common Expression Language (CEL) output. An attacker can specify a literal target, such as another tenant's RoleBinding, which the cluster-wide background controller then mutates to add attacker subjects or alter Roles, NetworkPolicies, and ConfigMaps.

Recommendations Update Kyverno to version 1.19.2 or later.