CVE-2026-122302 Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check
CriticalCVSS 9.3
- Published
- Updated
- Exploit status
- No public exploit known
Description
Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kyverno | < 1.19.2 | 1.19.2 |
References
- GitHub Security Advisory (GHSA-q62c-r9v2-cf64) vendor-advisory
- VulnCheck Advisory: Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check third-party-advisory