CVE-2026-122312 Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String

What is CVE-2026-122312?

CVE-2026-122312 is a high-severity vulnerability in kyverno, published on 5 Nov 2026.

Official description

Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.

Weakness: CWE-269

Which versions are affected by CVE-2026-122312?

It affects 1 product.

Products include Kyverno.

How do I fix CVE-2026-122312?

No fix has been published for CVE-2026-122312 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-122312 being exploited?

There is no known exploitation of CVE-2026-122312 in the wild and no public exploit code.

Other vulnerabilities in kyverno

• CVE-2026-22039 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall Critical 10.0
• CVE-2026-4789 CVE-2026-4789 Critical 9.8
• CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy Critical 9.4
• CVE-2026-122304 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader Critical 9.4
• CVE-2026-122310 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-j5qr-vw59-8jh6, GHSA-pcx2-xcq4-65vf.