BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-122308Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest

Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a ConfigMap as managed-by kyverno with crafted policy, rule, and trigger labels to clone sensitive Secrets from restricted namespaces into their own namespace.

8.4 HIGHEPSS 0.23%Not in KEVNVD: Undergoing Analysis

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
8.4HIGH4.0VulnCheck (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
8.5HIGH3.1VulnCheck (CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Details

CVE ID
CVE-2026-122308
Status
Undergoing Analysis
Assigner (CNA)
VulnCheck
Published
Nov 5, 2026
Last modified
2026-11-05 14:58 UTC
Weaknesses
  • CWE-639 · Authorization Bypass Through User-Controlled Key

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:27 UTC.