CVE-2026-122302: Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check
Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeting other namespaces or cluster-scoped kinds, making the background controller create or clone resources cluster-wide.
Event History
Frequently Asked Questions
Who can exploit this issue?
A namespace administrator who can create a namespaced Kyverno Policy with generate rules can exploit it. No prior cluster-wide RBAC permissions are required for the resources the policy causes Kyverno to create.
What access does an attacker need and how is it exploited?
The attacker needs network access to the affected Kyverno admission path and permission to create a namespaced Policy. They can add generate rules that target another namespace or a cluster-scoped resource kind, after which Kyverno's background controller creates or clones the resources using the controller's permissions.
Are cluster-scoped resources in scope?
Yes. A malicious namespaced Policy can use generate rules to target cluster-scoped kinds as well as resources in other namespaces, potentially extending the impact beyond the attacker's own namespace.
What version resolves the issue?
The issue affects Kyverno versions before 1.19.2. Upgrading to version 1.19.2 or later resolves the described permission-check behavior.