CVE-2026-122304 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader

What is CVE-2026-122304?

CVE-2026-122304 is a critical vulnerability in kyverno, published on 5 Nov 2026.

Official description

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.

Weakness: CWE-863

Which versions are affected by CVE-2026-122304?

It affects 1 product.

Products include Kyverno.

How do I fix CVE-2026-122304?

No fix has been published for CVE-2026-122304 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-122304 being exploited?

There is no known exploitation of CVE-2026-122304 in the wild and no public exploit code.

Other vulnerabilities in kyverno

• CVE-2026-22039 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall Critical 10.0
• CVE-2026-4789 CVE-2026-4789 Critical 9.8
• CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy Critical 9.4
• CVE-2026-122310 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath Critical 9.4
• CVE-2026-122311 Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vhcf-rq9h-r35p.