CVE Alert: CVE-2026-124441 – kyverno

Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule’s kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged background-controller to write NetworkPolicies or RoleBindings into victim or kube-system namespaces.

**Risk verdict:** High risk for multi-tenant clusters where users can create policies; confirmed exploitation urgency is uncertain because KEV, SSVC, PoC and EPSS data were not supplied.

**Why this matters:** A tenant may be able to make the privileged controller write resources beyond their namespace. This could enable changes that disrupt network controls or grant access, creating routes to sensitive workloads and further compromise.

**Most likely attack path:** A network-reachable user with low-level permissions creates a policy and triggers it, with no user interaction or complex conditions required. The assessed scope is unchanged, but writes made by the controller could still affect other namespaces and support lateral movement.

**Who is most exposed:** Prioritise shared Kubernetes clusters that let tenants or delegated teams create policies, especially where the controller can write sensitive resource types across namespaces.

Audit policy creation and changes by low-privilege identities, particularly variable-based targets.

Alert on controller-attributed writes to unexpected namespaces or sensitive resource types.

Review audit events for sudden RoleBinding or NetworkPolicy creation and changes.

Correlate policy triggers with ConfigMap creation by tenant identities.

Mitigation and prioritisation:

Upgrade promptly to the vendor-fixed release or later; verify all controller components are updated.

Until patched, restrict policy creation to trusted administrators and review existing generate rules.

Limit the controller’s permissions and use admission controls to block unauthorised cross-namespace writes.

Test policy reconciliation and access controls in staging; plan production rollout with rollback coverage.

Obtain KEV, SSVC, PoC and EPSS status; if KEV is confirmed or EPSS is at least 0.5, treat as priority 1.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.