← CVE Radar
CVE-2026-122311Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument
Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.
9.4 CRITICALEPSS 0.44%Not in KEVNVD: Undergoing Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.4 | CRITICAL | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| 9.9 | CRITICAL | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-122311
- Status
- Undergoing Analysis
- Assigner (CNA)
- VulnCheck
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 14:58 UTC
- Weaknesses
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
As published by the CNA in the CVE record.
kyvernokyverno1 version range
- 1.16.0 before 1.19.2