High priorityDisclosed

Advisory · CVE-2026-122312

Kyverno APICall Fetch can be tricked by a query string into cluster scope

Kyverno 1.19.1 before 1.19.2 has a namespace isolation bypass in APICall Fetch(): path.Clean treats ? as a path character, so a URLPath like /api/v1/nodes?x=/namespaces/default/ passes validation while client-go requests the cluster-scoped endpoint. Kyverno rates it CVSS 4.0 8.3.

Advisory published November 5, 2026Independent summary
Vendor
Kyverno
Product
Kyverno
Identifier / CWE
CVE-2026-122312
CWE-269
Action timing
Immediate
ELI5

Explain it like I’m five

The namespace check reads the address one way and the HTTP client reads it another. A '?' in the middle makes the two disagree, and the client wins.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Policy with crafted URLPath

    A user who can create namespaced policies supplies a URLPath such as /api/v1/nodes?x=/namespaces/default/.

  2. 02Validation is fooled

    path.Clean treats ? as a path character, so the namespace regex matches segments inside the query string.

  3. 03Client requests cluster scope

    client-go requests the cluster-scoped endpoint instead of the namespaced one.

  4. 04Resources read outside the namespace

    The user reads resources outside their namespace with Kyverno's permissions.

What happened

Kyverno disclosed CVE-2026-122312 for Kyverno 1.19.1 before 1.19.2. The APICall Fetch() function in pkg/engine/apicall/apiCall.go has a namespace isolation bypass: path.Clean treats ? as a path character, letting the namespace regex match segments inside the query string. A user who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.

The advisory rates it CVSS 4.0 8.3 and identifies Kyverno 1.19.2 as the fixed release.

What to do

  1. Inventory Kyverno installations and confirm the deployed version.
  2. Upgrade affected installations to Kyverno 1.19.2 or later using the project release guidance.
  3. While remediation is underway, limit who can create policies with context.apiCall entries.
  4. Review Kubernetes audit logs for apiCall URLPath values containing ? and for cluster-scoped reads from Kyverno’s ServiceAccount.
  5. Check which resources were read through the bypass and assess exposure.

Management note

This is the quieter sibling of the apiCall urlPath flaw in the same release: same control, different parsing gap. Patching one without the other leaves the door open.