CVE-2026-84200: Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., 'ingress'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kyvernoto a version that resolves this vulnerability.Fixed in v1.13.0
Event History
Frequently Asked Questions
Which deployments are affected?
Kyverno versions v1.9.0 through v1.12.7 are affected when an enforce-mode policy is combined with two PolicyExceptions. Version v1.13.0 fixes the issue.
What must an attacker be able to do to exploit this?
An attacker needs the ability to create or submit a resource whose name can be crafted to match the name pattern in the second, less restrictive PolicyException. No user interaction is required.
How can we determine whether a policy is exposed?
Review enforce-mode policies that have two PolicyExceptions and identify whether the second exception has a broader or less restrictive resource-name pattern. A resource name matching that second pattern, such as '*ingress*', may bypass the policy.
What can be done before upgrading?
Avoid pairing an enforce-mode policy with multiple PolicyExceptions where the second exception is less restrictive or uses broad name matching. Consolidating or tightening exception name patterns can reduce the bypass condition until Kyverno is upgraded to v1.13.0.