CVE-2026-122312: Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String

Published Nov 5, 2026

Updated

Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.

Event History

Nov 5, 2026

CVE Published

via MITRE·02:25 AM

Data Sourced

via MITRE·02:25 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs permission to create namespaced Kyverno policies. They can then craft an APICall URLPath whose query string contains a namespace-looking path segment, allowing the policy to pass namespace validation while requesting a cluster-scoped Kubernetes API endpoint.

What information can be exposed?

The issue can be used to read resources outside the attacker's namespace through cluster-scoped API endpoints, such as the nodes endpoint shown in the affected URLPath example. The provided data describes a confidentiality impact and does not identify integrity or availability impact.

Are default deployments affected?

The affected range is Kyverno 1.19.1 before 1.19.2. Exploitation additionally depends on whether untrusted or insufficiently trusted users can create namespaced policies that use APICall Fetch().

How can I identify potentially affected policies?

Review namespaced Kyverno policies using APICall Fetch() and inspect URLPath values for query strings containing path-like namespace segments, such as a '?' followed by values resembling '/namespaces/<namespace>/'. Such paths may pass namespace validation while causing client-go to request a different, potentially cluster-scoped endpoint.

CVE-2026-122312: Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are default deployments affected?

How can I identify potentially affected policies?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are default deployments affected?

How can I identify potentially affected policies?