CVE-2026-122316 in Kyverno
Summary
by MITRE • 11/05/2026
Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions, making the background-controller ServiceAccount strip Pod Security labels cluster-wide.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The Kyverno admission controller and policy engine, specifically in versions prior to 1.19.2, contains a critical missing authorization vulnerability within its mutate-existing background processor. This flaw stems from an insufficient access control check that fails to properly validate the scope of mutations applied by namespaced policies against cluster-wide resources or resources outside the tenant's designated namespace. In Kubernetes environments utilizing Kyverno for policy enforcement, administrators often deploy NamespacedMutatingPolicies intended to apply specific configurations only within a particular namespace boundary. However, due to this authorization gap, an attacker with permissions to create such policies can exploit CEL expressions and target selectors that inadvertently or intentionally affect resources beyond the allowed scope. This represents a significant breach of multi-tenancy isolation principles, allowing lower-privileged users to exert influence over cluster-level configurations or other tenants' workloads.
The technical mechanism of this vulnerability involves the interaction between the background controller's mutation logic and Kubernetes RBAC permissions. When a NamespacedMutatingPolicy is created by a user within a specific namespace, Kyverno’s background processor scans existing resources for compliance with that policy. The flaw lies in the fact that the authorization check does not strictly enforce namespace boundaries during this scanning and subsequent modification phase if the policy utilizes certain CEL expressions or targets Namespace objects themselves. By crafting a malicious NamespacedMutatingPolicy that uses Common Expression Language (CEL) to target specific labels, such as Pod Security Standards labels, an attacker can cause the background controller's ServiceAccount to strip these security-critical labels from pods across all namespaces in the cluster. This action effectively disables mandatory pod security restrictions enforced by Kubernetes or other tools like OPA Gatekeeper, leaving workloads vulnerable to privilege escalation and container escape attacks.
The operational impact of this vulnerability is severe, as it undermines the fundamental security posture of a multi-tenant Kubernetes cluster. By stripping Pod Security labels cluster-wide, attackers can revert hardened pods back to their default, less secure states. This allows for potential lateral movement within the cluster, unauthorized access to sensitive data stored in volumes or environment variables, and increased risk of container breakout exploits that rely on privileged containers or specific security contexts being disabled. Furthermore, because this occurs via a background process triggered by policy creation rather than immediate admission control, it may bypass real-time monitoring tools that focus solely on incoming API requests, making detection more difficult without comprehensive audit log analysis. The ability to modify resources outside one's namespace violates the principle of least privilege and compromises data confidentiality and integrity for all tenants sharing the cluster infrastructure.
To mitigate this vulnerability, organizations must immediately upgrade Kyverno to version 1.19.2 or later, where these authorization checks have been hardened to strictly enforce namespace boundaries during mutation operations. In addition to upgrading, administrators should review existing NamespacedMutatingPolicies and remove any that utilize broad CEL expressions targeting cluster-wide resources or Namespace objects unless absolutely necessary for legitimate operational purposes. Implementing strict RBAC roles that limit the ability of non-admin users to create mutating policies is also recommended as a defense-in-depth measure. Regular auditing of Kyverno policy executions and monitoring for unexpected changes in Pod Security labels across namespaces can help detect any residual exploitation attempts before they lead to significant security incidents. Aligning these practices with CWE-269, Improper Privilege Management, and ATT&CK techniques related to Defense Evasion such as T1562.008, Impair Defenses via Policy Modification, ensures a robust posture against similar future threats.