CVE-2026-100706

Name of the Vulnerable Software and Affected Versions kyverno versions prior to 1.19.1

Description Insufficient validation of URL-encoded path segments in the Policy apiCall urlPath allows namespace tenants to bypass the per-namespace clamp. This enables the creation of objects in other namespaces using the admission-controller ServiceAccount. By utilizing percent-encoded directory traversal sequences, an attacker can create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects within the kyverno namespace, leading to privilege escalation to cluster admin.

Recommendations Update kyverno to version 1.19.1 or later.