CVE-2026-100707 in Kyverno
Riassunto
di MITRE • 26/09/2026
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and read resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.