Vulnerability Details CVE-2026-122303
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target with an attacker-chosen metadata.namespace, causing the privileged background controller to overwrite Secrets, Deployments, or policies cluster-wide.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 25.1%
CVSS Severity
CVSS v3 Score 9.9
References
Products affected by CVE-2026-122303
-
cpe:2.3:a:kyverno:kyverno:1.17.0
-
cpe:2.3:a:kyverno:kyverno:1.17.1
-
cpe:2.3:a:kyverno:kyverno:1.17.2
-
cpe:2.3:a:kyverno:kyverno:1.18.0
-
cpe:2.3:a:kyverno:kyverno:1.18.1
-
cpe:2.3:a:kyverno:kyverno:1.18.2
-
cpe:2.3:a:kyverno:kyverno:1.19.0
-
cpe:2.3:a:kyverno:kyverno:1.19.1