CVE-2026-41068 Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)
Namespace admins can bypass RBAC to read ConfigMaps from any namespace via Kyverno's privileged service account, exposing sensitive cluster data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41068?
CVE-2026-41068 is a high-severity missing authorization vulnerability in kyverno, published on 24 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMap context loader has the identical vulnerability — the `configMap.namespace` field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters. An updated fix is available in version 1.17.2.
Weakness: CWE-863
Which versions are affected by CVE-2026-41068?
4 open source packages ship an affected version, including github.com/kyverno/kyverno and kyverno. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kyverno/kyverno Go | All versions | None |
github.com/kyverno/kyverno Go | All versions to 1.17.1 | None |
github.com/kyverno/kyverno Go | All versions to 1.17.1 | None |
kyverno Bitnami | All versions | 1.17.2 |
Products include Kyverno Kyverno.
How do I fix CVE-2026-41068?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-41068 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41068 exists.
Other vulnerabilities in kyverno
- CVE-2026-22039 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
- CVE-2026-4789 CVE-2026-4789
- CVE-2025-46342 Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements
- CVE-2026-41323 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
- CVE-2026-40868 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
Sources
Also known as BIT-kyverno-2026-41068, ECHO-b1b9-37a5-8821, GHSA-cvq5-hhx3-f99p, GO-2026-5337, MINI-2wcq-6jh8-ghjc, MINI-5ppv-qm35-6vjf and 13 more.