PT-2026-4953 · Kyverno · Kyverno

Thevilledev

·

Published

2026-01-27

·

Updated

2026-05-15

·

CVE-2026-22039

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.16.3 and 1.15.3
Description Kyverno, a policy engine for cloud native platform engineering teams, contains a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved urlPath is executed using the Kyverno admission controller ServiceAccount without enforcing namespace limitations. This allows any authenticated user with permission to create a namespaced Policy to perform Kubernetes API requests using Kyverno’s admission controller identity, potentially targeting any API path allowed by that ServiceAccount’s RBAC. This breaks namespace isolation, enabling cross-namespace reads of resources like ConfigMaps and Secrets, and allows cluster-scoped or cross-namespace writes, such as creating ClusterPolicies, by controlling the urlPath through context variable substitution. The vulnerability exists in how Kyverno handles apiCall context entries, specifically the variable substitution on the URLPath field without proper sanitization or authorization validation. An attacker can construct any valid API path to access and mutate resources they shouldn't have access to. This can lead to data exfiltration, disruption of the entire cluster by creating malicious ClusterPolicy resources, and potential privilege escalation. The vulnerability affects both data retrieval and the ability to create cluster-level resources.
Recommendations Update Kyverno to version 1.16.3 or 1.15.3.

Exploit

Fix

LPE

Improper Privilege Management

SSRF

Weakness Enumeration

Related Identifiers

BIT-KYVERNO-2026-22039
CLEANSTART-2026-GK29346
CLEANSTART-2026-UQ68343
CLEANSTART-2026-WB12909
CLEANSTART-2026-WI71304
CVE-2026-22039
GHSA-8P9X-46GM-QFX2
GO-2026-4381
SUSE-SU-2026:0403-1

Affected Products

Kyverno