Authorization Bypass Vulnerability in Kyverno by Nirmata

CVE-2026-122304

What is CVE-2026-122304?

Kyverno versions prior to 1.19.2 have an authorization bypass vulnerability that permits namespace admins to escape their confinement. This flaw stems from the cleanup controller’s context loader, which is constructed with a nil policy. By leveraging this vulnerability, attackers can create namespaced CleanupPolicies with apiCall or globalReference context entries, enabling them to read cross-namespace Secrets and alter validating webhook configurations by exploiting the cleanup controller’s ServiceAccount.

References