CVE-2026-124440

Name of the Vulnerable Software and Affected Versions Kyverno version 1.19.1

Description An authorization bypass exists in the apiCall namespace clamp. This issue allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to the urlPath variable. An attacker can create namespaced Policies where the apiCall executes using the admission-controller ServiceAccount, enabling them to read resources from other namespaces and create mutating webhooks to escalate privileges to cluster admin.

Recommendations Update Kyverno version 1.19.1 to 1.19.2.