CVE-2026-124441: Kyverno before 1.19.2 Authorization Bypass via Variable Generate Target Kind

Published Nov 8, 2026

Updated

Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged background-controller to write NetworkPolicies or RoleBindings into victim or kube-system namespaces.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kyverno to a version that resolves this vulnerability.
Fixed in 1.19.2

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Clusters running Kyverno before 1.19.2 are exposed if namespaced tenants can create Policies and ConfigMaps in their own namespaces. Those tenants may be able to cause the privileged background-controller to create resources in other namespaces, including kube-system.

What does an attacker need to exploit the bypass?

An attacker needs permissions to create a Policy and a triggering ConfigMap in a namespace they control. The Policy must use variables to template the generate rule's target kind and namespace.

What is the potential impact of successful exploitation?

An attacker can generate arbitrary resource kinds in arbitrary namespaces through the privileged background-controller. Examples described include creating NetworkPolicies or RoleBindings in victim namespaces or kube-system.

How can I tell whether my deployment is affected?

Check whether Kyverno is running a version earlier than 1.19.2. Also review whether namespaced users or tenants can create Kyverno Policies and ConfigMaps, particularly Policies with generate rules that template the target kind or namespace using variables.

CVE-2026-124441: Kyverno before 1.19.2 Authorization Bypass via Variable Generate Target Kind

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the bypass?

What is the potential impact of successful exploitation?

How can I tell whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the bypass?

What is the potential impact of successful exploitation?

How can I tell whether my deployment is affected?