CVE-2026-122307 in Kyverno
Summary
by MITRE • 11/05/2026
Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyExceptions can inject negated matchConditions into the generated policies to admit violating resources, bypassing cluster-wide enforcement.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Kyverno versions prior to 1.19.2 represents a critical security flaw within the admissionpolicygenerator controller, specifically affecting how policy exceptions are processed and integrated into ValidatingAdmissionPolicies. This issue stems from an improper implementation of access control checks during the generation phase of policies. The core technical failure lies in the controller's inability to correctly respect configuration flags such as --enablePolicyException and --exceptionNamespace, along with failing to enforce proper validation based on policy kind restrictions. Consequently, the system allows PolicyExceptions to be folded into generated ValidatingAdmissionPolicies without verifying whether these exceptions should legitimately apply within the current context or namespace scope defined by cluster administrators.
From a technical perspective, this flaw enables users who possess namespaced create permissions for PolicyExceptions objects to manipulate the behavior of cluster-wide admission policies. By injecting negated matchConditions into the generated policies, an attacker can effectively neutralize security controls that are intended to block specific resource configurations or actions across the entire Kubernetes cluster. The mechanism relies on the fact that ValidatingAdmissionPolicies evaluate conditions sequentially, and a carefully crafted negation in a PolicyException can cause the policy to skip enforcement for targeted resources, thereby allowing them to bypass validation rules that would otherwise reject their creation or modification.
The operational impact of this vulnerability is severe, as it undermines the principle of least privilege and cluster-wide security governance. Attackers with limited namespace-level permissions can escalate their influence by disabling critical admission controls at the cluster level. This allows for the deployment of misconfigured workloads, unauthorized network policies, or other resources that violate organizational security standards without triggering alerts or rejections from Kyverno's enforcement mechanisms. Such bypasses compromise the integrity of the supply chain and expose the cluster to potential exploitation through insecure configurations that were intended to be strictly prohibited by central policy management tools.
This vulnerability aligns with CWE-250, which describes execution with unnecessary privileges, as well as CWE-862, involving missing authorization checks during critical operations. In terms of adversarial tactics, it corresponds to MITRE ATT&CK technique T1499, Endpoint Denial of Service, when used to disrupt security monitoring, or more accurately T1530, Data from Cloud Storage Object Misconfiguration, if the bypass leads to data exposure through insecure resource states. It also reflects aspects of privilege escalation by leveraging lower-privileged accounts to disable high-level controls.
To mitigate this risk, organizations must immediately upgrade Kyverno to version 1.19.2 or later, where these logic errors in the admissionpolicygenerator controller have been corrected. Administrators should review existing PolicyExceptions and ValidatingAdmissionPolicies for any anomalies that may indicate exploitation of this flaw before upgrading. Additionally, implementing strict RBAC policies that limit who can create or modify PolicyExceptions is essential to reduce the attack surface. Regular audits of policy enforcement logs against expected outcomes will help detect any instances where validation rules were unexpectedly bypassed due to malformed exception handling logic.