CVE-2026-100706
Summary
by MITRE • 09/26/2026
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Kyverno versions prior to 1.19.1 represents a critical security flaw rooted in insufficient input validation within the policy engine's API call mechanism. Specifically, the system fails to properly sanitize or validate URL-encoded path segments provided in the urlPath parameter of apiCall policies. This oversight allows malicious actors who have access to create or modify Kyverno policies within their designated namespace to manipulate how subsequent HTTP requests are constructed and executed by the admission controller service account. The core technical failure lies in the parsing logic, which does not adequately decode percent-encoded characters before evaluating path constraints, thereby permitting directory traversal sequences such as dot-dot-slash encoded variants to bypass intended boundary checks.
This flaw directly undermines the per-namespace isolation model that Kyverno is designed to enforce. By exploiting this validation gap, an attacker can craft a malicious policy configuration where the urlPath contains percent-encoded traversal characters that resolve to paths outside the allowed namespace scope when processed by the underlying HTTP client or routing logic. Consequently, operations intended to be restricted to the tenant's own namespace are instead executed against cluster-wide resources or sensitive system namespaces like kyverno itself. This effectively neutralizes the security boundary between multi-tenant environments, allowing a lower-privileged user to perform actions that should require elevated privileges.
The operational impact of this vulnerability is severe, leading directly to privilege escalation from a standard namespace tenant to cluster administrator level. Attackers can leverage this access vector to create MutatingWebhookConfiguration objects at the cluster scope or inject PolicyException objects into the kyverno system namespace. Creating a cluster-wide mutating webhook allows an attacker to intercept and modify all admission requests across the entire Kubernetes cluster, effectively granting them control over every resource creation event. Alternatively, inserting policy exceptions in the kyverno namespace can disable security controls for specific workloads or allow unauthorized policies to run without restriction. Both scenarios result in a complete compromise of cluster integrity, enabling data exfiltration, persistence mechanisms, and lateral movement within the environment.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to verify that user-supplied input conforms to expected formats before processing it for security-critical decisions. It also relates to CWE-732 Incorrect Permission Assignment for Critical Resource, due to the failure to enforce namespace-based access controls correctly during API calls. In terms of adversary tactics, this exploit maps to MITRE ATT&CK technique T1484 Domain Policy Modification and potentially T1506 Post-exploitation techniques involving webhook manipulation or policy abuse within Kubernetes environments. The exploitation path demonstrates how misconfigured validation rules can be weaponized to escalate privileges in container orchestration platforms.
To mitigate this risk, organizations must immediately upgrade Kyverno to version 1.19.1 or later, where the input validation logic has been hardened to correctly handle URL-encoded sequences and enforce strict namespace boundaries for apiCall operations. In addition to upgrading, administrators should audit existing policies for any use of urlPath parameters that accept user-controlled input and ensure that least-privilege principles are strictly applied to service accounts associated with admission controllers. Implementing network policies to restrict outbound traffic from the Kyverno controller can also limit the blast radius if a policy is compromised. Regular security assessments focusing on Kubernetes API server interactions and webhook configurations are recommended to detect similar validation bypasses in other components of the cluster infrastructure.