CVE-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
Attackers can escalate privileges to cluster admin by bypassing namespace restrictions via URL-encoded path traversal in policy API calls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100706?
CVE-2026-100706 is a critical vulnerability in kyverno, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.
Weakness: CWE-441
Which versions are affected by CVE-2026-100706?
1 open source package ship an affected version, including kyverno.
| Package | Affected | Fixed in |
|---|---|---|
kyverno Bitnami | All versions | 1.19.1 |
How do I fix CVE-2026-100706?
Upgrade kyverno to 1.19.1 or later.
Is CVE-2026-100706 being exploited?
There is no known exploitation of CVE-2026-100706 in the wild and no public exploit code.
Sources
Also known as BIT-kyverno-2026-100706, GHSA-5qq8-67g6-4h2w, GHSA-j68q-wq49-88gg, MINI-2fvw-whc2-rhwf, MINI-32c2-qpwf-r7gj, MINI-3xvc-wcm4-x4h6 and 10 more.