Namespace Isolation Bypass Vulnerability in Kyverno by Nirmata

CVE-2026-122312

What is CVE-2026-122312?

Kyverno versions prior to 1.19.2 exhibit a vulnerability that allows attackers to bypass namespace isolation through a flaw in the APICall Fetch() function. Specifically, the use of path.Clean interprets '?' as a path character, enabling regex matches in namespace policies that can unlawfully access cluster-scoped endpoints. This weakness permits users with permissions to create namespaced policies to construct URLs that validate, yet allow client-go to interact with resources outside their authorized namespace, posing a significant security risk.

References