Authorization Bypass Vulnerability in Kyverno by Nirmata

CVE-2026-122303

What is CVE-2026-122303?

An authorization bypass vulnerability in Kyverno versions prior to 1.19.2 allows namespace tenants to manipulate resources across different namespaces. By exploiting the NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression, an attacker can craft a CEL map literal that masquerades under an arbitrary metadata.namespace. This leads to a situation where the privileged background controller can inadvertently overwrite critical cluster-wide resources such as Secrets, Deployments, or policies. Organizations using affected versions are strongly advised to update to the latest version for enhanced security.

References