Kyverno before 1.19.2 has a critical privilege escalation flaw: namespace admins can use generate rules to create resources beyond their RBAC permissions, including in other namespaces and at cluster scope.
What Is It
CVE-2026-122302 is a privilege escalation vulnerability (CWE-269, Improper Privilege Management) in Kyverno, the Kubernetes policy engine. When a generate rule goes through admission, Kyverno checks the permissions of its own controller, not the permissions of the user who wrote the policy.
An attacker can therefore create a namespaced Policy with generate rules that target other namespaces or cluster-scoped kinds. Kyverno's background controller then creates or clones those resources cluster-wide, using its own privileges.
VulnCheck disclosed the flaw. NVD published it on 2026-11-05, and its status is currently "Awaiting Analysis."
Why It Matters
VulnCheck scores the flaw as critical:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL
Both vectors say no privileges are required. The advisory description, however, says the attacker is a namespace admin. Defenders should take the description as the realistic precondition: someone who can author a namespaced Policy.
That precondition matters because namespace-scoped admin rights are often handed to tenants, teams, or CI systems in multi-tenant clusters. If Kyverno's controller is more privileged than those users, this flaw lets them borrow its permissions and break namespace isolation. They could create or clone resources in namespaces they don't control, or create cluster-scoped objects.
Exploitation status: CVE-2026-122302 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. The supplied data contains no exploitation reports.
What's Vulnerable
- Product: Kyverno (
pkg:golang/github.com/kyverno/kyverno) - Affected: all versions before 1.19.2
- Unaffected: 1.19.2
Exposure is highest in clusters where non-cluster-admin users can create namespaced Kyverno Policy resources with generate rules.
Patch Status
The fix is in Kyverno 1.19.2. Upgrade any deployment running an earlier version.
Since the CVE is not in KEV, CISA has set no required action or due date. Until you can upgrade, review who is allowed to create namespaced Kyverno Policies. Also audit existing Policies for generate rules that target other namespaces or cluster-scoped kinds.