CVE-2026-122308: Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest

Published Nov 5, 2026

Updated

Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a ConfigMap as managed-by kyverno with crafted policy, rule, and trigger labels to clone sensitive Secrets from restricted namespaces into their own namespace.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kyverno to a version that resolves this vulnerability.
Fixed in 1.19.2

Event History

Nov 5, 2026

CVE Published

via MITRE·02:25 AM

Data Sourced

via MITRE·02:25 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user who has create or update permission for ConfigMaps and can apply crafted Kyverno internal generate labels may exploit it. The described impact is the ability to trigger synchronized generate policies that clone Secrets from restricted namespaces into the attacker's namespace.

Are deployments using default behavior affected?

The issue concerns synchronized generate policies in Kyverno's Generation Handler. The provided information does not establish whether such policies are enabled or present in a default deployment.

What should teams do to remediate it?

Upgrade Kyverno to version 1.19.2 or later. If immediate patching is not possible, review and restrict who can create or update ConfigMaps, particularly in namespaces where they could use crafted Kyverno generate labels.

How can I investigate possible exploitation?

Review ConfigMaps marked as managed by Kyverno and inspect their generate policy, rule, and trigger labels for unexpected or crafted values. Also investigate Secrets appearing in namespaces that should not have access to Secrets from restricted namespaces.

CVE-2026-122308: Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are deployments using default behavior affected?

What should teams do to remediate it?

How can I investigate possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are deployments using default behavior affected?

What should teams do to remediate it?

How can I investigate possible exploitation?