CVE-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib
Tenants can access cluster-scoped cached data from other namespaces via the globalcontext library, bypassing RBAC restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100703?
CVE-2026-100703 is a high-severity vulnerability in kyverno, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. A tenant who can create a namespaced policy (e.g. NamespacedValidatingPolicy, and likewise the namespaced mutating, deleting, generating, and image-validating policy kinds) in their own namespace can call globalContext.get("<entry>", "") and receive the full cached contents of a cluster-scoped GlobalContextEntry, including data cached from namespaces the tenant has no RBAC permission to read. No admission validation rejects such calls. Fixed in 1.19.1.
Weakness: CWE-200
Which versions are affected by CVE-2026-100703?
1 open source package ship an affected version, including kyverno.
| Package | Affected | Fixed in |
|---|---|---|
kyverno Bitnami | From 1.16.0 | 1.19.1 |
How do I fix CVE-2026-100703?
Upgrade kyverno to 1.19.1 or later.
Is CVE-2026-100703 being exploited?
There is no known exploitation of CVE-2026-100703 in the wild and no public exploit code.
Sources
Also known as BIT-kyverno-2026-100703, GHSA-59v6-2x73-wfg4, GHSA-cmr3-jwxg-m6m3, MINI-76q7-cch4-wfpp, MINI-c953-mmv6-rgwq, MINI-hr4c-83gw-ggc8 and 3 more.