CVE-2026-84200 in Kyverno
Summary
by MITRE • 09/01/2026
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
Kyverno versions ranging from 1.9.0 through 1.12.7 contain a critical logic flaw within the policy exception handling mechanism that undermines the intended security posture of Kubernetes cluster governance. This vulnerability arises specifically when an enforce-mode policy is evaluated against resources governed by multiple PolicyExceptions. The core technical defect lies in the precedence rules applied during conflict resolution between overlapping exceptions. Instead of adhering to a strict least-privilege principle or evaluating exceptions based on specificity and order, Kyverno incorrectly grants precedence to the less restrictive exception among those that match a given resource. This behavior creates a predictable bypass vector where an attacker can manipulate resource metadata to align with broader, more permissive exception patterns rather than stricter ones, effectively neutralizing the protective controls defined in enforce-mode policies.
The operational impact of this flaw is significant for organizations relying on Kyverno to enforce strict security baselines and compliance requirements. By crafting a resource name that matches the pattern of a less restrictive PolicyException, such as using a wildcard like 'ingress', an attacker can circumvent critical restrictions. For instance, if a policy is designed to block the use of hostPath volumes for security reasons, but two exceptions exist—one narrowly scoped and one broadly scoped—the flawed logic allows the broader exception to take precedence. This enables unauthorized workloads to mount sensitive host directories or access other restricted resources that should have been blocked by the primary enforcement policy. The ability to bypass these controls compromises the integrity of the cluster, potentially leading to container escape, data exfiltration, or lateral movement within the environment.
From a classification perspective, this vulnerability aligns with CWE-829, which denotes Inclusion of Functionality from Untrusted Control Sector, as it involves improper control over security-critical functionality due to flawed logic in exception handling. It also relates to CWE-693, Protection Mechanism Failure, where the system fails to prevent unauthorized actions despite having defined controls. Furthermore, this behavior can be mapped to MITRE ATT&CK technique T1548.002, Abuse Elevation Control Mechanism: Bypass User Interface Restrictions, as it exploits a logical flaw in how access control exceptions are processed rather than breaking cryptographic or network barriers directly. The vulnerability represents a failure in the principle of least privilege enforcement within policy engines, where exception handling logic inadvertently expands permissions beyond what is explicitly intended by administrators.
To mitigate this risk, organizations must immediately upgrade Kyverno to version 13.0 or later, which resolves the precedence logic error and ensures that exceptions are evaluated correctly according to security best practices. Until an upgrade can be performed, administrators should audit their PolicyException configurations to ensure no overlapping exceptions exist with conflicting restrictiveness levels. It is advisable to consolidate multiple exceptions into a single, precisely scoped exception where possible to eliminate ambiguity in matching rules. Additionally, implementing rigorous monitoring and logging for policy violations can help detect attempts to exploit this flaw by observing unexpected resource creations that bypass standard enforcement checks. Regular reviews of policy configurations against current Kyverno documentation are essential to maintain alignment with the intended security model and prevent similar logical flaws from being introduced or exploited in future deployments.