Authorization Flaw in Kyverno Allows Namespace Resource Modification

CVE-2026-122316

What is CVE-2026-122316?

A missing authorization vulnerability has been identified in Kyverno versions up to 1.19.1 that enables unauthorized namespaced tenants to modify resources outside their designated namespace. This flaw permits attackers to craft a NamespacedMutatingPolicy targeting Namespace objects or sensitive resources in victim namespaces through CEL expressions. Consequently, the background-controller ServiceAccount may inadvertently strip Pod Security labels across the entire cluster, posing serious security implications.

References