Privilege Escalation in Kyverno by Pomerium Labs

CVE-2026-122302

What is CVE-2026-122302?

Kyverno versions prior to 1.19.2 are susceptible to a privilege escalation vulnerability that allows malicious namespace administrators to bypass Role-Based Access Control (RBAC) constraints. This is due to ineffective checks in the generate-rule admission that validate the controller’s permissions rather than the author’s permissions. As a consequence, attackers can construct namespaced Policies with generate rules that target resources in other namespaces or even cluster-scoped objects, enabling them to create or clone resources across the entire cluster.

References