CVE-2026-100706GHSA-5qq8-67g6-4h2w
kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
kyverno kyverno
CVSS
9.4CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.61%Chance of exploitation activity in the next 30 days, higher than 48% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.19.1kyvernoCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.
Text from CVE List
Affected versions 2
- kyvernoaffected: all versions before 1.19.1CVE List
- kyvernounaffected: 1.19.1CVE List