High priorityDisclosed

Advisory · CVE-2026-122316

Kyverno mutate-existing can strip Pod Security labels cluster-wide

Kyverno 1.17.0 before 1.19.2 has a missing authorization check in the mutate-existing background processor: namespaced tenants can modify resources outside their namespace through NamespacedMutatingPolicy CEL expressions. Kyverno rates it CVSS 3.1 8.5.

Advisory published November 5, 2026Independent summary
Vendor
Kyverno
Product
Kyverno
Identifier / CWE
CVE-2026-122316
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

A background job that applies policy changes never checks whether the policy author owns the target. A tenant can aim it at Namespace objects and strip safety labels off the whole cluster.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Mutating policy created

    A namespaced tenant creates a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions.

  2. 02Background processor runs

    The mutate-existing background processor applies the change with the controller's ServiceAccount.

  3. 03No authorization check

    The processor does not verify the author may modify the target.

  4. 04Pod Security labels stripped

    The background-controller ServiceAccount strips Pod Security labels cluster-wide.

What happened

Kyverno disclosed CVE-2026-122316 for Kyverno 1.17.0 before 1.19.2. The mutate-existing background processor has a missing authorization vulnerability: namespaced tenants can modify resources outside their namespace by creating a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions, making the background-controller ServiceAccount strip Pod Security labels cluster-wide.

The advisory rates it CVSS 3.1 8.5 and identifies Kyverno 1.19.2 as the fixed release.

What to do

  1. Inventory Kyverno installations and confirm the deployed version.
  2. Upgrade affected installations to Kyverno 1.19.2 or later using the project release guidance.
  3. While remediation is underway, limit who can create NamespacedMutatingPolicy objects.
  4. Review Kubernetes audit logs for NamespacedMutatingPolicy objects and for changes to Namespace objects and Pod Security labels.
  5. Verify Pod Security labels on all namespaces and restore any that were stripped.

Management note

Stripping Pod Security labels cluster-wide quietly lowers the security posture of every workload. Even if nothing else was changed, re-verify the labels after patching.