CVE-2026-122311 Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument

What is CVE-2026-122311?

CVE-2026-122311 is a critical vulnerability in kyverno, published on 5 Nov 2026.

Official description

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.

Weakness: CWE-22

Which versions are affected by CVE-2026-122311?

It affects 1 product.

Products include Kyverno.

How do I fix CVE-2026-122311?

No fix has been published for CVE-2026-122311 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-122311 being exploited?

There is no known exploitation of CVE-2026-122311 in the wild and no public exploit code.

Other vulnerabilities in kyverno

• CVE-2026-22039 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall Critical 10.0
• CVE-2026-4789 CVE-2026-4789 Critical 9.8
• CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy Critical 9.4
• CVE-2026-122304 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader Critical 9.4
• CVE-2026-122310 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-4pqm-wqq6-h9q2, GHSA-p59g-p6q6-8969.