Kyverno: apiCall urlPath is validated after cleaning but executed raw, reaching cluster-scoped endpoints

Impact

Kyverno validates a Policy's context.apiCall urlPath after normalising it, but executes the raw string; the Kubernetes client then discards the fragment or query portion. A tenant can hide ../ segments behind a # or ? so the validated path looks namespace-confined while the executed request reaches cluster-scoped endpoints with Kyverno's own ServiceAccount, which is effectively cluster admin. On a shared GPU cluster this takes a single namespace-scoped tenant to full control of the control plane: read every secret, mutate RBAC, reach any tenant's workloads and nodes. The admission controller is the trust boundary here, so there is no second layer behind it.

Who can reach it

An authenticated tenant who can create a Policy in one namespace. Kubernetes API access only - no node or GPU access required.

What to do

Upgrade Kyverno from 1.19.1 to 1.19.2 or later per the GitHub advisory. Controller rollout and pod restart; no node drain, no GPU workload impact beyond a brief admission gap during the rolling restart. Interim mitigation: deny tenants the ability to create Policy objects, or block policies that use context.apiCall.

References

Related entries

• Kyverno: unvalidated path segments in CEL resource.get/post let namespaced policies escape their namespaceCVE-2026-122311 · Kyverno CEL policies (resource.get / resource.post path segments)Critical
• Kyverno: NamespacedMutatingPolicy target expressions lack namespace checks, enabling cross-namespace mutationCVE-2026-122313 · Kyverno NamespacedMutatingPolicy (targetMatchConstraints.expression)Critical
• Kyverno: namespace-scoped policy escapes its namespace clamp and escalates to cluster adminCVE-2026-124440 · Kyverno admission controller (apiCall urlPath namespace clamp)Critical
• Harbor: Hard-coded default credentials give web UI access to the whole registryCVE-2026-4404 · HarborCritical
• Azure Kubernetes Service: incorrect authorization lets an authorized attacker elevate privileges remotelyCVE-2026-50516 · Microsoft Azure Kubernetes Service (authorization checks)Critical
• containerd: CRI plugin propagates unvalidated image LABEL values into container configCVE-2026-53488 · containerdCritical