High priorityDisclosed

Advisory · CVE-2026-122307

Kyverno policy generator folds exceptions past its own safety gates

Kyverno before 1.19.2 has a policy bypass in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the enablePolicyException, exceptionNamespace, and policy kind gates. Kyverno rates it CVSS 4.0 8.3.

Advisory published November 5, 2026Independent summary
Vendor
Kyverno
Product
Kyverno
Identifier / CWE
CVE-2026-122307
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

Kyverno has switches that say when exceptions are allowed, but the generator that builds policies ignores them. Anyone who can write an exception can carve a hole in cluster-wide rules.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01PolicyException created

    A user with namespaced create rights on PolicyExceptions writes one.

  2. 02Generator folds it in

    The admissionpolicygenerator controller folds the exception into generated ValidatingAdmissionPolicies.

  3. 03Gates ignored

    The --enablePolicyException, --exceptionNamespace, and policy kind gates are not checked.

  4. 04Enforcement bypassed

    Negated matchConditions admit resources that should violate cluster-wide policy.

What happened

Kyverno disclosed CVE-2026-122307 for Kyverno before 1.19.2. The admissionpolicygenerator controller folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the –enablePolicyException, –exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyExceptions can inject negated matchConditions into the generated policies to admit violating resources, bypassing cluster-wide enforcement.

The advisory rates it CVSS 4.0 8.3 and identifies Kyverno 1.19.2 as the fixed release.

What to do

  1. Inventory Kyverno installations and confirm the deployed version.
  2. Upgrade affected installations to Kyverno 1.19.2 or later using the project release guidance.
  3. While remediation is underway, limit who can create PolicyException objects.
  4. Review generated ValidatingAdmissionPolicies for negated matchConditions that do not match an intended exception.
  5. Check audit logs for PolicyException objects created outside the expected namespaces.

Management note

Exceptions are the pressure valve on policy enforcement, and this flaw lets any namespaced user open it. If you run Kyverno with PolicyExceptions enabled, treat this as a bypass of your cluster-wide rules until patched.