Kyverno: APICall URLPath query string defeats the namespace regex, reading cluster-scoped resources

Impact

path.Clean treats '?' as an ordinary path character, so the namespace regex that is meant to confine a namespaced policy's APICall can be satisfied by a segment inside the query string while client-go actually requests the cluster-scoped endpoint. A tenant who can create namespaced policies can therefore read resources outside their namespace through Kyverno's service account - node objects, and whatever else that account can list. On a multi-tenant GPU cluster that is a cross-tenant read: node inventory and labels reveal GPU topology and placement, and other namespaces' objects may carry configuration a tenant should not see. The read runs with Kyverno's privileges, not the tenant's, which is what makes a namespaced policy author dangerous here.

Who can reach it

Any authenticated tenant with create rights on namespaced Kyverno policies that use APICall. Authentication required; no cluster-scoped read rights of their own.

What to do

Upgrade Kyverno to 1.19.2 or later (only 1.19.1 is affected) and restart the Kyverno pods; the fix is commit f67231d. Interim: restrict who may create namespaced policies containing APICall context entries, and consider trimming the Kyverno service account's cluster-wide read permissions. Control-plane only.

References

Related entries

• Kyverno: templated generate.clone namespace copies another tenant's ConfigMaps into the attacker's namespaceCVE-2026-122320 · Kyverno background controller (generate.clone / cloneList namespace templating)High
• docker-socket-proxy: CONTAINERS access lets any client export container filesystems and read filesCVE-2026-78122 · Tecnativa docker-socket-proxy (/containers read endpoints)High
• Kyverno: admission controller ServiceAccount token attached to outbound apiCall requests leaks to any endpointCVE-2026-84195 · Kyverno admission controller (apiCall service mode)High
• Kyverno: SSRF via apiCall.service.url lets authenticated users reach internal and metadata endpointsCVE-2026-84196 · Kyverno admission controller (apiCall.service.url variable substitution)High
• Kubernetes (kubelet): /debug/pprof exposed on the unauthenticated kubelet healthz portCVE-2019-11248 · Kubernetes (kubelet)High
• Envoy: JWT with an issuer absent from the provider list bypasses JWT authenticationCVE-2021-21378 · EnvoyHigh