Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-01 | 1 | Patch1 |
| 2026-09-02 | 1 | Disclosure1 |
#cloudsecurity Kritische Kyverno-Lücke erlaubt Policy-Bypass über PolicyExceptions #cve202684200 #kyverno #v1130 https://cybersecurity-news.de/cve-2026-84200-kyverno-policy-bypass-policyexceptions
Post summary
The post announces a critical Kyverno vulnerability that allows policy bypass through PolicyExceptions, providing basic technical insight but no evidence of exploitation, PoC, or patches.
🚨Critical - Kyverno PolicyException Precedence Enforcement Bypass (CVE-2026-84200) Kyverno policy exception handling in enforce mode can mis-evaluate when 2 PolicyExceptions exist: a less restrictive exception pattern (e.g., http://match.name: "*ingress*") can take precedence over a stricter one. Attackers can name crafted resources to hit the broader exception and bypass policy enforcement (e.g., allow hostPath volumes). 👉Affected: http://github.com/kyverno/kyverno v1.9.0-1.12.7 | Upgrade to 1.13.0
Post summary
The post discloses a critical Kyverno policy exception precedence bypass (CVE‑2026‑84200), explains how two exceptions can be mis‑ordered to allow hostPath mounts, and recommends upgrading to version 1.13.0 to remediate.