PT-2026-4953 · Kyverno · Kyverno
Thevilledev
·
Published
2026-01-27
·
Updated
2026-05-15
·
CVE-2026-22039
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Kyverno versions prior to 1.16.3 and 1.15.3
Description
Kyverno, a policy engine for cloud native platform engineering teams, contains a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved
urlPath is executed using the Kyverno admission controller ServiceAccount without enforcing namespace limitations. This allows any authenticated user with permission to create a namespaced Policy to perform Kubernetes API requests using Kyverno’s admission controller identity, potentially targeting any API path allowed by that ServiceAccount’s RBAC. This breaks namespace isolation, enabling cross-namespace reads of resources like ConfigMaps and Secrets, and allows cluster-scoped or cross-namespace writes, such as creating ClusterPolicies, by controlling the urlPath through context variable substitution. The vulnerability exists in how Kyverno handles apiCall context entries, specifically the variable substitution on the URLPath field without proper sanitization or authorization validation. An attacker can construct any valid API path to access and mutate resources they shouldn't have access to. This can lead to data exfiltration, disruption of the entire cluster by creating malicious ClusterPolicy resources, and potential privilege escalation. The vulnerability affects both data retrieval and the ability to create cluster-level resources.Recommendations
Update Kyverno to version 1.16.3 or 1.15.3.
Exploit
Fix
LPE
Improper Privilege Management
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Kyverno