A critical flaw in Kyverno before v1.13.0 lets an attacker sidestep enforce-mode admission policies by naming a resource so it matches a second, less restrictive PolicyException.
What Is It
CVE-2026-84200 is an access control flaw (CWE-284) in Kyverno's policy exception handling. When a policy running in enforce mode is paired with two PolicyExceptions, the less restrictive exception takes precedence. An attacker can exploit this by crafting a resource name that matches the second exception's name pattern, for example, a pattern like *ingress*, causing the enforcing policy to be bypassed entirely.
The issue was disclosed via VulnCheck and is tracked in the Kyverno project's GitHub security advisory GHSA-gg4x-fgg2-h9w9.
Why It Matters
Kyverno is a Kubernetes admission controller; a bypass here means guardrails that cluster operators believe are enforced are not. The advisory specifically cites circumventing a policy that blocks hostPath volumes; a control that exists to stop workloads from mounting the host filesystem.
The flaw carries a CVSS 3.1 base score of 9.0 (CRITICAL, CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and a CVSS 4.0 score of 9.4 (CRITICAL). The 3.1 vector describes an adjacent-network attack with low complexity, no user interaction, and only low privileges required, with high confidentiality, integrity, and availability impact. Its S:C (scope changed) metric is what reflects that a successful bypass reaches beyond Kyverno itself into the cluster it is supposed to protect; CVSS 3.1 has no separate vulnerable-system versus subsequent-system impact metrics, since that split is a CVSS 4.0 construct.
What's Vulnerable
- Product: Kyverno (
pkg:golang/github.com/kyverno/kyverno) - Affected versions: all versions prior to v1.13.0, per the CVE record
- Not affected: v1.13.0 and later
- Precondition: an enforce-mode policy combined with two PolicyExceptions
Patch Status
Fixed in Kyverno v1.13.0. Upgrading to v1.13.0 or later is the remediation. As an interim measure, operators should review clusters for policies paired with multiple PolicyExceptions, since that is the configuration the bypass requires.
This CVE is not listed in the CISA KEV catalog, so there is no KEV-confirmed active exploitation and no KEV-mandated due date. Exploit maturity in the CVSS 4.0 vector is Not Defined. The NVD record was published 2026-09-01 and remains in "Received" status, so details may change.
Sources
- Kyverno GitHub Security Advisory (GHSA-gg4x-fgg2-h9w9), https://github.com/kyverno/kyverno/security/advisories/GHSA-gg4x-fgg2-h9w9
- VulnCheck Advisory; https://www.vulncheck.com/advisories/kyverno-before-1.13.0-policy-bypass-via-multiple-exceptions
- NVD record for CVE-2026-84200 (affected version range, CVSS 3.1/4.0 scoring, record status), https://nvd.nist.gov/vuln/detail/CVE-2026-84200
- CWE-284: Improper Access Control; https://cwe.mitre.org/data/definitions/284.html
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog