Vulnerability Details CVE-2026-122304
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 33.7%
CVSS Severity
CVSS v3 Score 9.9