CVE-2026-100707GHSA-c5qq-7g2q-cpqp
Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path
kyverno kyverno
CVSS
8.3HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.46%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.19.1kyvernoCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in urlPath to bypass namespace checks and read resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials.
Text from CVE List
Affected versions 2
- kyvernoaffected: all versions before 1.19.1CVE List
- kyvernounaffected: 1.19.1CVE List