Kyverno’s ConfigMap context loader accepts an arbitrary namespace value without validation, enabling a namespace admin to read ConfigMaps from any namespace using Kyverno’s privileged service account. This flaw constitutes a complete RBAC bypass in multi‑tenant Kubernetes clusters, allowing unintended disclosure of configuration data vulnerability mirrors the prior CVE-2026-22039 fix, and in the current version the patch is only incomplete.

The Kyverno policy engine, any release prior to version 1.17.2, is affected. All other editions run natively on Kubernetes and employ the same ConfigMap context loader.

Evaluated with a CVSS score of 7.7, the EPSS score is below 1%, and the vulnerability is not listed in CISA KEV. The exploit requires a privileged Kyverno service account and sufficient access to specify a ConfigMap context. An attacker can target the ConfigMap context loader to retrieve configuration data from any namespace, potentially revealing secrets and enabling further privilege escalation. The risk is moderate but exploitability is low due to the need for Kubernetes RBAC privileges.