Kyverno: namespaced CleanupPolicy context entries run with the cleanup controller's ServiceAccount

Impact

In Kyverno 1.17.0 through 1.19.1 the cleanup controller builds its context loader with a nil policy, so namespace confinement is never applied to context entries. A namespace admin can create a namespaced CleanupPolicy whose apiCall or globalReference context entries run with the cleanup controller's own ServiceAccount, reading Secrets in other namespaces and modifying validatingwebhookconfigurations. Disabling or rewriting a validating webhook configuration is the step that precedes everything else on a shared GPU cluster: it switches off the admission checks that stop privileged pods and host device mounts, after which a tenant can ask for the host directly. This is a separate flaw from the mutate-existing target bypass (CVE-2026-122303) in the same release, with its own controller and its own advisory.

Who can reach it

Authenticated namespace admin who can create a CleanupPolicy in a namespace they control; no cluster-scoped permissions needed.

What to do

Upgrade Kyverno to 1.19.2 and restart the cleanup controller deployment. In the interim remove tenant RBAC for namespaced CleanupPolicy objects, review existing CleanupPolicies for apiCall and globalReference context entries, and verify that no validatingwebhookconfiguration has been altered.

References

Related entries

• Kyverno: apiCall urlPath is validated after cleaning but executed raw, reaching cluster-scoped endpointsCVE-2026-122310 · Kyverno admission controller (Policy context.apiCall urlPath)Critical
• Kyverno: unvalidated path segments in CEL resource.get/post let namespaced policies escape their namespaceCVE-2026-122311 · Kyverno CEL policies (resource.get / resource.post path segments)Critical
• Kyverno: NamespacedMutatingPolicy target expressions lack namespace checks, enabling cross-namespace mutationCVE-2026-122313 · Kyverno NamespacedMutatingPolicy (targetMatchConstraints.expression)Critical
• Kyverno: namespace-scoped policy escapes its namespace clamp and escalates to cluster adminCVE-2026-124440 · Kyverno admission controller (apiCall urlPath namespace clamp)Critical
• Harbor: Hard-coded default credentials give web UI access to the whole registryCVE-2026-4404 · HarborCritical
• Azure Kubernetes Service: incorrect authorization lets an authorized attacker elevate privileges remotelyCVE-2026-50516 · Microsoft Azure Kubernetes Service (authorization checks)Critical