Kyverno: namespaced mutating policy can fabricate cross-namespace targets and overwrite cluster-wide resources

Impact

In Kyverno 1.17.0 through 1.19.1, a NamespacedMutatingPolicy using mutate-existing can return a CEL map literal from targetMatchConstraints.expression that fabricates a target with an attacker-chosen metadata.namespace. The privileged background controller then applies the mutation there, so a tenant confined to one namespace can overwrite Secrets, Deployments or policies anywhere in the cluster. On a shared GPU cluster that is a direct tenant-to-tenant and tenant-to-platform break: rewrite another tenant's workload spec, replace image pull or registry secrets, or neuter the admission policies that keep privileged GPU pods in check. Kyverno itself is the control that operators rely on to constrain device access, so the failure is in the enforcement layer.

Who can reach it

Any tenant with permission to create a NamespacedMutatingPolicy in a namespace they own; authenticated, no cluster-level rights needed.

What to do

Upgrade Kyverno to 1.19.2 and roll the admission and background controller deployments; no node drain or reboot required. Until then, remove the RBAC that lets tenants create NamespacedMutatingPolicy objects and audit existing namespaced mutating policies for targetMatchConstraints expressions returning fabricated namespaces.

References

Related entries

• Kyverno: namespaced CleanupPolicy context entries run with the cleanup controller's ServiceAccountCVE-2026-122304 · Kyverno cleanup controller (CleanupPolicy context loader)Critical
• Kyverno: apiCall urlPath is validated after cleaning but executed raw, reaching cluster-scoped endpointsCVE-2026-122310 · Kyverno admission controller (Policy context.apiCall urlPath)Critical
• Kyverno: unvalidated path segments in CEL resource.get/post let namespaced policies escape their namespaceCVE-2026-122311 · Kyverno CEL policies (resource.get / resource.post path segments)Critical
• Kyverno: NamespacedMutatingPolicy target expressions lack namespace checks, enabling cross-namespace mutationCVE-2026-122313 · Kyverno NamespacedMutatingPolicy (targetMatchConstraints.expression)Critical
• Kyverno: namespace-scoped policy escapes its namespace clamp and escalates to cluster adminCVE-2026-124440 · Kyverno admission controller (apiCall urlPath namespace clamp)Critical
• Harbor: Hard-coded default credentials give web UI access to the whole registryCVE-2026-4404 · HarborCritical