CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions
Attackers can bypass Kyverno enforcement policies by exploiting exception precedence, allowing unauthorized resources like hostPath volumes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84200?
CVE-2026-84200 is a critical vulnerability in kyverno, published on 1 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.
Weakness: CWE-284
Which versions are affected by CVE-2026-84200?
4 open source packages ship an affected version, including github.com/kyverno/kyverno and kyverno.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kyverno/kyverno Go | From 1.9.0 | 1.13.0 |
github.com/kyverno/kyverno Go | From 1.9.0 | 1.13.0 |
github.com/kyverno/kyverno Go | From 1.9.0 | 1.13.0 |
kyverno Bitnami | All versions | 1.13.0 |
How do I fix CVE-2026-84200?
Upgrade github.com/kyverno/kyverno to 1.13.0 or later.
Is CVE-2026-84200 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84200 exists.
Sources
Also known as BIT-kyverno-2026-84200, GHSA-gg4x-fgg2-h9w9, GHSA-q8fv-357q-9mmj, GO-2026-4285, MINI-2hx7-wv3g-7j83, MINI-4j7g-jqxw-4cfq and 4 more.