CVE-2026-122307: Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling

Published Nov 5, 2026

Updated

Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyExceptions can inject negated matchConditions into the generated policies to admit violating resources, bypassing cluster-wide enforcement.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kyverno to a version that resolves this vulnerability.
Fixed in 1.19.2

Event History

Nov 5, 2026

CVE Published

via MITRE·02:25 AM

Data Sourced

via MITRE·02:25 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs namespaced create permission on PolicyExceptions. They can use that access to inject negated matchConditions into ValidatingAdmissionPolicies generated by the admissionpolicygenerator controller.

Are deployments affected even if PolicyExceptions are disabled or restricted by configuration?

Yes. The affected controller ignores the --enablePolicyException and --exceptionNamespace settings, as well as policy kind gates, when folding PolicyExceptions into generated policies.

What is the impact of a successful exploit?

The attacker can cause resources that violate cluster-wide policies to be admitted. This bypasses the intended enforcement performed by the generated ValidatingAdmissionPolicies.

What should be prioritized if immediate upgrading is not possible?

Restrict namespaced create rights on PolicyExceptions, since that permission is required to inject the conditions used for the bypass.

CVE-2026-122307: Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected even if PolicyExceptions are disabled or restricted by configuration?

What is the impact of a successful exploit?

What should be prioritized if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are deployments affected even if PolicyExceptions are disabled or restricted by configuration?

What is the impact of a successful exploit?

What should be prioritized if immediate upgrading is not possible?