CVE-2026-122303

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

http://github.com/kyverno/kyverno

Full discourse1 post

Upwind Security MDR@UpwindMDR2d
🚨Critical - Kyverno Privilege Escalation & Image Verification Bypass CVE-2026-122302, CVE-2026-122303, CVE-2026-122304, CVE-2026-122310, CVE-2026-122311, CVE-2026-122313, CVE-2026-122321 Namespace isolation and authorization flaws let users with policy-creation permissions abuse Kyverno’s privileged ServiceAccounts to access or modify resources across namespaces, alter RBAC, and potentially take over the cluster. A separate image-verification cache flaw lets attackers controlling an image tag bypass signature and attestation checks by repointing a previously verified tag. 👉Affected: http://github.com/kyverno/kyverno versions before 1.19.2; exact ranges vary by CVE | Upgrade to 1.19.2
0000079
388 followersView on X

Explore more

Back to dashboard