{"id":"CVE-2026-122310","published":"2026-11-05T03:17:23.337","lastModified":"2026-11-05T03:17:23.337","description":"Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # or ? to reach cluster-scoped endpoints with Kyverno's ServiceAccount, gaining cluster admin.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-436"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4","tags":[]},{"url":"https://www.vulncheck.com/advisories/kyverno-1.19.1-before-1.19.2-privilege-escalation-via-policy-apicall-urlpath","tags":[]}],"exploitRefs":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4","tags":[]}],"hasPoc":true,"ai":{"summary":"A Kyverno policy validation flaw allows namespace-scoped users to bypass scope restrictions by embedding path traversal sequences in URL fragments or query strings, causing the system to execute cluster-scoped API calls with elevated privileges despite validating a sanitized version of the path.","exploitability":"Exploitation requires low skill and only a namespace-scoped user with permission to create Kyverno policies; no external access or complex tooling is needed.","blast_radius":"Successful exploitation grants attackers cluster-admin-level access via Kyverno’s ServiceAccount, enabling full compromise of confidentiality, integrity, and availability across the entire cluster.","remediation":"Upgrade to Kyverno 1.19.2 or later, which validates and executes the same cleaned path instead of the raw path containing hidden traversal sequences.","detection":"Monitor Kyverno policy creation events for paths containing URL-encoded or unencoded '#' or '?' characters followed by '...' segments; log entries showing Policy objects with such malformed paths may indicate attempted exploitation.","tags":["path-traversal","privilege-escalation","kubernetes","kyverno","api-abuse"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:44:36.105Z"}}