Kyverno versions v1.9.0 through v1.12.7 contain a flaw in policy exception handling that allows an attacker to bypass an enforce‑mode policy when two PolicyExceptions are configured. The less‑restrictive exception takes precedence, so an attacker can craft a resource name that matches the second exception’s pattern (for example '*ingress*'), thereby circumventing the policy and enabling unauthorized configurations such as hostPath volumes. This represents an unauthorized alteration of cluster resources and a direct breach of policy enforcement, classified as an authorization weakness (CWE‑284).

Vendor Kyverno offers the Kyverno policy engine for Kubernetes. The vulnerability affects all Kyverno releases from 1.9.0 up to and including 1.12.7; a remedied version is 1.13.0 or later.

The vulnerability carries a CVSS score of 9.4, indicating critical severity. Exploitation requires a user with permission to create or modify resources in a Kubernetes cluster that utilizes Kyverno 1.9.0 through 1.12.7, policies in enforce mode, and multiple configured PolicyExceptions. An attacker can exploit the flaw by creating a resource whose name matches the second exception pattern, causing the less‑restrictive exception to override the stricter policy. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, so the exact likelihood of exploitation is uncertain; however, the potential impact remains high because bypassing hard policies can lead to privilege escalation or data exfiltration through abused hostPath volumes.