CVE-2026-100707

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.1

Description An issue exists in the apiCall context entry of namespaced Policy resources caused by inconsistent path interpretation between validation and execution. A low-privilege tenant can utilize percent-encoded dot-segments in the urlPath variable to bypass namespace isolation checks. This allows the attacker to read resources from other namespaces by leveraging the Kyverno admission controller's ServiceAccount credentials.

Recommendations Update to version 1.19.1 or later.