Skip to content

CVE-2026-122311 Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument

CriticalCVSS 9.4
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.

Affected products

ProductAffected versionsFixed in
kyverno >= 1.16.0, < 1.19.2 1.19.2

References