CVE-2026-124441 Kyverno before 1.19.2 Authorization Bypass via Variable Generate Target Kind
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-124441?
CVE-2026-124441 is a high-severity vulnerability in kyverno, published on 8 Nov 2026.
Official description
Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged background-controller to write NetworkPolicies or RoleBindings into victim or kube-system namespaces.
Weakness: CWE-863
Which versions are affected by CVE-2026-124441?
How do I fix CVE-2026-124441?
No fix has been published for CVE-2026-124441 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-124441 being exploited?
There is no known exploitation of CVE-2026-124441 in the wild and no public exploit code.
Sources
Also known as GHSA-rgfv-hhgv-g9h3, GHSA-vjfx-fp68-rh4v.