HIGH 8.3 NVD
CVE-2026-122307
Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingA
Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyExceptions can inject negated matchConditions into the generated policies to admit violating resources, bypassing cluster-wide enforcement.
References
- https://github.com/kyverno/kyverno/security/advisories/GHSA-qc9c-3fgf-cgq8
- https://www.vulncheck.com/advisories/kyverno-before-1.19.2-policy-bypass-via-admissionpoli
This high severity vulnerability with a CVSS score of 8.3 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16624 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.