Kyverno up to 1.15.2/1.16.2 Admission Controller Service privileges management

Summaryinfo

A vulnerability identified as critical has been detected in Kyverno up to 1.15.2/1.16.2. Impacted is an unknown function of the component Admission Controller Service. This manipulation causes privileges management. This vulnerability is handled as CVE-2026-22039. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Kyverno up to 1.15.2/1.16.2. It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component Admission Controller Service. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved `urlPath` is executed using the Kyverno admission controller ServiceAccount, with no enforcement that the request is limited to the policy’s namespace. As a result, any authenticated user with permission to create a namespaced Policy can cause Kyverno to perform Kubernetes API requests using Kyverno’s admission controller identity, targeting any API path allowed by that ServiceAccount’s RBAC. This breaks namespace isolation by enabling cross-namespace reads (for example, ConfigMaps and, where permitted, Secrets) and allows cluster-scoped or cross-namespace writes (for example, creating ClusterPolicies) by controlling the urlPath through context variable substitution. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-22039 since 01/05/2026. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.15.3 or 1.16.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1152). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source Kyverno

Productinfo

Name

• Kyverno

Version

• 1.15.0
• 1.15.1
• 1.15.2
• 1.16.0
• 1.16.1
• 1.16.2

Website

• Product: https://github.com/kyverno/kyverno/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion