CRITICAL 9.4 NVD
CVE-2026-100706
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace cla
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.
References
- https://github.com/kyverno/kyverno/security/advisories/GHSA-5qq8-67g6-4h2w
- https://www.vulncheck.com/advisories/kyverno-before-1.19.1-privilege-escalation-via-policy
This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-09-26 via NVD.
Risk Timeline
CVE Disclosed2026-09-26 · -1 days ago
Remediation Resources
vulnfeed aggregates 11675 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.