CRITICAL 9.4 NVD
CVE-2026-124440
Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-nam
Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers can create namespaced Policies whose apiCall runs as the admission-controller ServiceAccount to read other namespaces' resources and create mutating webhooks, escalating to cluster admin.
References
- https://github.com/kyverno/kyverno/security/advisories/GHSA-39w8-hv5g-f73w
- https://www.vulncheck.com/advisories/kyverno-1.19.1-privilege-escalation-via-apicall-names
This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-11-08 via NVD.
Risk Timeline
CVE Disclosed2026-11-08 · -1 days ago
Remediation Resources
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.