CVE-2026-122302: Kyverno privilege escalation in generate-rule permission checks

CVE-2026-122302 · Severity: critical · CVSS 9.8 · Published 2026-11-05

Kyverno is a policy engine for Kubernetes that controls what resources can be created in a cluster. A privilege escalation flaw allows namespace administrators to bypass role-based access controls by creating policies that instruct Kyverno's background controller to create or replicate resources across namespaces and cluster-wide—resources the admin themselves couldn't normally create. This gives attackers a foothold to proliferate malicious configurations throughout the cluster.

Technologies: Kyverno. Vendors: Kyverno.

Quick answers

Is CVE-2026-122302 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-122302 being exploited in the wild.
How severe is CVE-2026-122302?
Critical severity, with a CVSS score of 9.8, published 5 November 2026.
Which products and versions are affected?
Kyverno before 1.19.2.
Is there a fix for CVE-2026-122302?
Yes: fixed in 1.19.2. Until then: Restrict the ability of namespace admins to create Policies and ClusterPolicies, or limit the kyverno controller's RBAC permissions to only the resources and actions strictly required for legitimate policy enforcement. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122302 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-122302?
Check whether you run Kyverno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.19.2

Restrict the ability of namespace admins to create Policies and ClusterPolicies, or limit the kyverno controller's RBAC permissions to only the resources and actions strictly required for legitimate policy enforcement.

Technical details

The vulnerability exists in the generate-rule admission validator, which checks whether the Kyverno controller service account has permission to create target resources, rather than checking the policy author's permissions. An attacker who is a namespace admin can create a namespaced Policy with generate rules that target other namespaces or cluster-scoped resources; the background controller will then perform the action using its elevated RBAC privileges. The flaw is compounded by the fact that the controller's RBAC role is aggregated to admin, allowing any namespace admin to create policies, and no validation binds a namespaced policy's targets to its own namespace.

Affected products

  • Kyverno Kyverno before 1.19.2

Timeline

  • 2026-10-21: disclosed: Published as GHSA-q62c-r9v2-cf64 on GitHub
  • 2026-11-04: advisory
  • 2026-11-05: patched: Fix released in version 1.19.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.