# CVE-2026-122312: Kyverno namespace isolation bypass in APICall URLPath

Source: https://junglewise.ai/threats/cve-2026-122312-kyverno-from-1-19-1-before-1-19-2-contains-a-namespace-isolation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-122312 · Severity: high · CVSS 7.7 · Published 2026-11-05

Kyverno is a Kubernetes policy engine that enforces security and compliance rules. A bypass in its APICall feature allows users with permission to create policies in a single namespace to access cluster-wide resources and secrets from other namespaces by injecting query parameters into API paths. This breaks tenant isolation and enables unauthorized data exfiltration.

Technologies: [Kyverno](https://junglewise.ai/threats/technologies/kyverno). Vendors: [Kyverno](https://junglewise.ai/threats/vendors/kyverno).

## Quick answers

**Is CVE-2026-122312 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122312 being exploited in the wild.

**How severe is CVE-2026-122312?** High severity, with a CVSS score of 7.7, published 5 November 2026.

**Which products and versions are affected?** Kyverno 1.19.1 before 1.19.2.

**Is there a fix for CVE-2026-122312?** Yes: fixed in 1.19.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122312 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-122312?** Check whether you run Kyverno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.19.2

## Technical details

The vulnerability is a URL parser differential in the APICall Fetch() function in pkg/engine/apicall/apiCall.go. The namespace validation regex is applied after path.Clean(), which treats query strings as literal path characters, allowing a malicious URLPath like /api/v1/nodes?x=/namespaces/default/ to pass validation. However, the HTTP execution layer uses standard URL parsing that separates query strings, causing the request to reach /api/v1/nodes (cluster-scoped) instead of a namespaced endpoint. Exploitation requires the ability to create namespaced policies, which is a normal privilege in multi-tenant Kyverno deployments.

## Affected products

- Kyverno Kyverno 1.19.1 before 1.19.2

## Timeline

- 2026-11-05: disclosed
- 2026-10-13: patched

## References

- [https://github.com/kyverno/kyverno/commit/f67231def576eb0ad153dd8cbfc836908ab14c14](https://github.com/kyverno/kyverno/commit/f67231def576eb0ad153dd8cbfc836908ab14c14)
- [https://github.com/kyverno/kyverno/security/advisories/GHSA-pcx2-xcq4-65vf](https://github.com/kyverno/kyverno/security/advisories/GHSA-pcx2-xcq4-65vf)

## Related threats

- [Kyverno authorization bypass in generate rule validation](https://junglewise.ai/threats/cve-2026-124441-kyverno-before-1-19-2-contains-an-authorization-bypass)
- [Kyverno apiCall authorization bypass in namespace clamp](https://junglewise.ai/threats/cve-2026-124440-kyverno-from-1-19-1-before-1-19-2-contains-an-authorization)
- [Kyverno unbounded decompression in notary signature fetch](https://junglewise.ai/threats/cve-2026-122323-kyverno-from-1-11-0-before-1-19-2-contains-an-unbounded)
- [Kyverno verifyImages signature verification bypass via cache](https://junglewise.ai/threats/cve-2026-122321-kyverno-1-18-0-before-1-19-2-contains-a-signature-verification)
- [Kyverno missing authorization in generate.clone namespace](https://junglewise.ai/threats/cve-2026-122320-kyverno-before-1-19-2-contains-a-missing-authorization)