Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-100706 kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp a… https://www.cve.org/CVERecord?id=CVE-2026-100706
🚨Critical - Kyverno apiCall urlPath Namespace Escape via URL-Encoded Traversal (CVE-2026-100706) Kyverno Policy apiCall.urlPath fails to validate percent-encoded path segments, allowing %2e%2e/ traversal to bypass per-namespace restrictions and create objects in other namespaces as the admission-controller ServiceAccount. Impact: cross-namespace object creation → cluster-wide privilege escalation (e.g., MutatingWebhookConfiguration, PolicyException in kyverno ns). 👉Affected: http://github.com/kyverno/kyverno < 1.19.1 | Upgrade to 1.19.1
CVE-2026-100706: How a Kyverno Tenant Becomes Cluster Admin https://xhack.io/blog/cve-2026-100706-kyverno-cluster-admin #CVE #cybersecurity #CISO https://t.co/TiMWhTHWc0
How the Namespace Fence Failed in CVE-2026-100706 https://t.co/KeyAc2nqXE