Skip to content

CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy

CriticalCVSS 9.4
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.

Affected products

ProductAffected versionsFixed in
kyverno >= 1.17.0, < 1.19.2 1.19.2

References