Authorization Flaw in Kyverno Allows Unauthorized Resource Access Across Namespaces

CVE-2026-122320

What is CVE-2026-122320?

Kyverno versions prior to 1.19.2 are susceptible to an authorization flaw that enables authors of namespaced Policies to access resources from different namespaces. By leveraging templated values in generate.clone or cloneList, attackers can manipulate a ConfigMap, allowing the background-controller to copy sensitive data from a victim's namespace into their own. This flaw opens the door to cross-tenant data disclosure, potentially exposing critical information across namespace boundaries.

References