Description
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.
Published: 2026-09-26
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

The vulnerability allows a tenant in a Kubernetes namespace to bypass the namespace clamp in policy apiCall urlPath. By sending URL‑encoded directory traversal sequences, the attacker can create MutatingWebhookConfiguration objects across the cluster or PolicyException objects in the kyverno namespace, which effectively grants cluster administrator privileges. The weakness is a lack of proper path validation (CWE‑441).

Affected Systems

All kyverno installations older than version 1.19.1 are affected. The product is the kyverno admission controller; only versions before 1.19.1 fail to validate encoded path segments.

Risk and Exploitability

This flaw carries a CVSS score of 9.4, indicating critical severity. The EPSS score is not available, but the lack of a CISA KEV listing does not diminish the high impact. Attackers can exploit the vector by making API requests to policy apiCall with crafted urlPath parameters, a scenario that is feasible for any user who can create policies within a namespace. Consequently, the risk is high and remediation is urgent.

Generated by OpenCVE AI on September 26, 2026 at 16:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade kyverno to version 1.19.1 or later, which fixes URL‑encoded path validation.
  • Restrict namespace permissions so that only trusted users can create policies that use apiCall urlPath.
  • Disable or tightly control the use of apiCall with urlPath in policies to mitigate potential privilege escalation until a patch is applied.

Generated by OpenCVE AI on September 26, 2026 at 16:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.
Title kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
First Time appeared Kyverno
Kyverno kyverno
Weaknesses CWE-441
CPEs cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*
Vendors & Products Kyverno
Kyverno kyverno
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Kyverno Kyverno
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-26T23:08:54.549Z

Reserved: 2026-09-26T02:40:23.372Z

Link: CVE-2026-100706

cve-icon Vulnrichment

Updated: 2026-09-26T23:08:51.823Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-26T14:16:55.843

Modified: 2026-09-28T15:20:06.633

Link: CVE-2026-100706

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T16:45:14Z

Weaknesses
  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')