Vulnerability Details CVE-2026-122316
Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions, making the background-controller ServiceAccount strip Pod Security labels cluster-wide.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 6.2%
CVSS Severity
CVSS v3 Score 8.5