CVE-2026-122316: Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting
Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions, making the background-controller ServiceAccount strip Pod Security labels cluster-wide.
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
Kyverno versions from 1.17.0 before 1.19.2 are affected where namespaced tenants can create NamespacedMutatingPolicy resources and the mutate-existing background processor is used.
What access does an attacker need?
An attacker needs permissions as a namespaced tenant to create a NamespacedMutatingPolicy. No user interaction is required, and the policy can use CEL expressions to target Namespace objects or resources in another namespace.
What is the practical impact of exploitation?
An attacker can cause cross-namespace modifications through Kyverno's background controller. One stated impact is stripping Pod Security labels from Namespace objects cluster-wide, potentially weakening enforced pod security controls.
What should be prioritized if an immediate upgrade is not possible?
Restrict untrusted namespaced tenants from creating NamespacedMutatingPolicy resources, particularly policies using mutateExisting. Review existing NamespacedMutatingPolicy objects for targets that select Namespace resources or resources outside the policy creator's namespace.