Authorization Bypass Vulnerability in Kyverno Before Version 1.19.2

CVE-2026-122308

What is CVE-2026-122308?

Kyverno versions prior to 1.19.2 exhibit an authorization bypass vulnerability within the Generation Handler. This flaw permits users with create/update permissions to exploit synchronized generate policies by crafting internal labels. By labeling a ConfigMap with the 'managed-by kyverno' designation along with specific policy, rule, and trigger labels, malicious actors can replicate sensitive secrets from restricted namespaces into their own. This exploitation underscores the need for robust security measures in managing Kubernetes policies to prevent unauthorized data exposure.

References