CVE-2026-122303: Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy

Published Nov 5, 2026

Updated

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.

Event History

Nov 5, 2026

CVE Published

via MITRE·02:25 AM

Data Sourced

via MITRE·02:25 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Clusters running Kyverno from 1.17.0 before 1.19.2 are affected where namespace tenants can create or control a NamespacedMutatingPolicy. The impact can extend beyond the tenant namespace because the privileged background controller can overwrite resources cluster-wide.

What does an attacker need to exploit it?

An attacker needs permissions sufficient to create or modify a NamespacedMutatingPolicy and configure its mutate-existing targetMatchConstraints.expression. They can use a CEL map literal to fabricate a target whose metadata.namespace is an attacker-chosen namespace.

What resources could be changed?

The vulnerable background controller can be induced to overwrite resources in other namespaces, including Secrets, Deployments, and policies. The reported impact includes confidentiality, integrity, and availability consequences.

How can I determine whether my cluster is affected?

Check whether Kyverno is running a version from 1.17.0 through versions before 1.19.2. Also identify whether untrusted or namespace-scoped tenants can create or modify NamespacedMutatingPolicy objects that use mutate-existing targetMatchConstraints.expression.

CVE-2026-122303: Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

What resources could be changed?

How can I determine whether my cluster is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

What resources could be changed?

How can I determine whether my cluster is affected?