{"id":"CVE-2026-122311","published":"2026-11-05T03:17:23.497","lastModified":"2026-11-05T03:17:23.497","description":"Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2","tags":[]},{"url":"https://www.vulncheck.com/advisories/kyverno-1.16.0-before-1.19.2-path-traversal-in-namespaced-cel-policies-via-resource-argument","tags":[]}],"exploitRefs":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2","tags":[]}],"hasPoc":true,"ai":{"summary":"Kyverno versions before 1.19.2 allow authenticated users with NamespacedValidatingPolicy permissions to escape their namespace by injecting '..' path segments in resource.get() and resource.post() calls, enabling unauthorized read/write access to cluster-scoped resources via the admission controller's ServiceAccount.","exploitability":"Exploitation requires low-privilege access to create or modify NamespacedValidatingPolicies and knowledge of valid CEL policy syntax; no external network access needed.","blast_radius":"Successful exploitation grants full cluster control through the admission controller’s high-privileged ServiceAccount, enabling lateral movement, data exfiltration, and persistent backdoor deployment.","remediation":"Upgrade Kyverno to version 1.19.2 or later.","detection":"Monitor for CEL policy objects containing '..' in resource.get() or resource.post() path arguments; inspect admission webhook logs for unexpected cluster-scoped resource access by namespaced policies.","tags":["cve","cel-injection","namespace-escape","rbac-bypass","kyverno"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:44:43.613Z"}}