{"id":"CVE-2026-124441","published":"2026-11-08T14:18:10.800","lastModified":"2026-11-08T14:18:10.800","description":"Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged background-controller to write NetworkPolicies or RoleBindings into victim or kube-system namespaces.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-vjfx-fp68-rh4v","tags":[]},{"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.2-authorization-bypass-via-variable-generate-target-kind","tags":[]}],"exploitRefs":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-vjfx-fp68-rh4v","tags":[]}],"hasPoc":true,"ai":{"summary":"Kyverno before 1.19.2 has an authorization bypass (CWE-863) where namespaced tenants can abuse generate rules to template arbitrary resource kinds and namespaces via variables, enabling them to create privileged resources like NetworkPolicies or RoleBindings in victim or kube-system namespaces using the background controller's elevated privileges.","exploitability":"Exploitation requires low skill and only standard Kyverno policy creation permissions within a tenant namespace, with no user interaction needed.","blast_radius":"Successful exploitation allows attackers to escalate privileges across namespaces—including into kube-system—potentially compromising cluster-wide security controls, data access, or workload integrity.","remediation":"Upgrade to Kyverno 1.19.2 or later.","detection":"Defenders should monitor for Policy resources containing generate rules with templated .kind or .namespace fields referencing external variables (e.g., {{request.object.metadata.name}} in the namespace field), especially when combined with high-privilege resource kinds like ClusterRoleBinding or NetworkPolicy; such policies, when applied and triggered, may indicate exploitation attempts.","tags":["auth-bypass","kubernetes","kyverno","privilege-escalation","generate-rule-abuse"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:46:01.918Z"}}