CVE-2026-122303 in Kyverno
Summary
by MITRE • 11/05/2026
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Kyverno versions prior to 1.19.2 represents a critical authorization bypass within the Kubernetes admission control and mutation engine architecture. Kyverno operates as a policy engine that enforces rules on resources entering or existing within a cluster, often running with high privileges to modify resource specifications automatically. The core flaw resides in how NamespacedMutatingPolicy objects handle target match constraints when utilizing CEL expressions for dynamic matching. Specifically, the vulnerability allows namespace tenants who possess permissions to create or update mutating policies to manipulate the evaluation context of these rules. By crafting a malicious CEL expression that returns a map literal containing a fabricated metadata.namespace field, an attacker can trick the Kyverno background controller into believing that a resource belongs to a different namespace than it actually does. This manipulation effectively bypasses the intended namespace isolation boundaries enforced by Kubernetes RBAC and Kyverno's own policy scoping mechanisms.
From a technical perspective, this flaw exploits the trust placed in CEL evaluation results during the mutation process. When Kyverno processes a mutating policy with mutate-existing targets, it evaluates whether existing resources match specific criteria defined in the rule. If an attacker controls the input data or can influence the context through a maliciously crafted policy definition, they can inject a false namespace identifier into the matched resource object. The privileged background controller then proceeds to apply mutations based on this falsified metadata. Since the controller operates with cluster-wide privileges to ensure policies are applied consistently across all namespaces, it will overwrite sensitive resources such as Secrets, Deployments, or even other policy definitions in target namespaces where the attacker has no direct write access. This constitutes a classic case of insecure direct object references combined with privilege escalation via misconfigured authorization logic.
The operational impact of this vulnerability is severe and potentially catastrophic for multi-tenant Kubernetes environments. An authenticated user within any namespace can escalate their privileges to achieve cluster-wide administrative control without needing elevated RBAC roles initially. By overwriting Secrets, an attacker could exfiltrate sensitive credentials or inject malicious ones into applications running in other namespaces. Overwriting Deployments allows for the execution of arbitrary code across multiple workloads, potentially leading to data breaches, service disruption, or further lateral movement within the cluster infrastructure. Furthermore, modifying policy definitions themselves can create persistent backdoors that survive pod restarts and persist even if initial access is revoked. This undermines the fundamental security model of Kubernetes multi-tenancy, where strict namespace isolation is expected to prevent cross-tenant interference.
This vulnerability aligns with CWE-269 Improper Privilege Management and CWE-787 Out-of-bounds Write in terms of its mechanism for bypassing intended access controls through memory or state manipulation concepts adapted to policy evaluation contexts. In the context of the MITRE ATT&CK framework, this behavior maps directly to T1098.004 SSH Authorized Keys Modification if viewed as persistent access establishment, but more accurately reflects T1531 Account Access Removal for disrupting availability and T1608 Install Defacement Tool or similar techniques for modifying system state. It also relates to T1499 Endpoint Denial of Service through resource overwriting. The attack vector is primarily local within the cluster namespace where the malicious policy is deployed, requiring initial access as a standard user with permissions to create mutating webhook configurations.
Mitigation strategies must focus on immediate version upgrades and strict input validation. Organizations running Kyverno should upgrade immediately to version 1.19.2 or later, where this authorization bypass has been patched by restricting how CEL expressions can influence the target namespace metadata during mutation operations. In addition to upgrading, administrators should enforce least-privilege principles for policy creation permissions, ensuring that only trusted service accounts with specific cluster-admin roles can define NamespacedMutatingPolicies rather than general users or automated CI/CD pipelines without rigorous review processes. Implementing OPA Gatekeeper as a complementary admission controller can provide an additional layer of validation to reject policies that attempt unauthorized mutations across namespace boundaries. Continuous monitoring for unusual policy creation events and unexpected resource modifications in namespaces not directly managed by the creating user is also recommended to detect potential exploitation attempts early.