Kyverno: unvalidated path segments in CEL resource.get/post let namespaced policies escape their namespace

Impact

The resource argument to resource.get() and resource.post() in Kyverno CEL policies is not checked for path segments, so a namespaced policy can insert .. and address objects outside its own namespace. The call runs as the admission controller's ServiceAccount, giving read and write to arbitrary cluster objects - cluster takeover from a single tenant namespace. On a multi-tenant GPU cluster the consequence is cross-tenant: secrets, RBAC and workload definitions belonging to other tenants are all in reach, and the attacker can place pods on any node pool. Distinct from the apiCall urlPath issue (CVE-2026-122310) - different code path, different affected range, starting at 1.16.0.

Who can reach it

An authenticated tenant who can create a NamespacedValidatingPolicy in their own namespace. Kubernetes API access only.

What to do

Upgrade Kyverno to 1.19.2 or later (affects 1.16.0 onwards) per the GitHub advisory. Controller rollout and pod restart, no node drain. Until then, restrict creation of NamespacedValidatingPolicy objects to cluster operators.

References

Related entries

• Kyverno: NamespacedMutatingPolicy target expressions lack namespace checks, enabling cross-namespace mutationCVE-2026-122313 · Kyverno NamespacedMutatingPolicy (targetMatchConstraints.expression)Critical
• Kyverno: namespace-scoped policy escapes its namespace clamp and escalates to cluster adminCVE-2026-124440 · Kyverno admission controller (apiCall urlPath namespace clamp)Critical
• Harbor: Hard-coded default credentials give web UI access to the whole registryCVE-2026-4404 · HarborCritical
• Azure Kubernetes Service: incorrect authorization lets an authorized attacker elevate privileges remotelyCVE-2026-50516 · Microsoft Azure Kubernetes Service (authorization checks)Critical
• containerd: CRI plugin propagates unvalidated image LABEL values into container configCVE-2026-53488 · containerdCritical
• Dokploy: registry password and URL interpolated unescaped into a swarm deploy commandCVE-2026-72879 · Dokploy registry credential handling (getRegistryCommands in cluster/upload.ts)Critical