Act nowDisclosed

Advisory · CVE-2026-124440

Kyverno namespace clamp bypass hands tenants the keys to the whole cluster

Kyverno 1.19.1 contains an authorization bypass in the apiCall namespace clamp that lets namespace tenants issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath, running as the admission-controller ServiceAccount to read other namespaces and create mutating webhooks, escalating to cluster admin, rated critical at CVSS 9.9; fixed in 1.19.2.

Advisory published November 8, 2026Independent summary
Vendor
Kyverno
Product
Kyverno
Identifier / CWE
CVE-2026-124440
CWE-441
Action timing
Immediate
ELI5

Explain it like I’m five

Kyverno is a guard that makes sure each tenant in a Kubernetes cluster stays in its own namespace. A flaw in how it checks web addresses lets a tenant smuggle in a mangled address that slips past the guard, so their requests run with the guard's own powerful identity and can reach every namespace.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Tenant creates a Policy

    A namespaced tenant authors a Policy with an apiCall.

  2. 02Malformed escape appended

    The urlPath carries malformed percent-escapes.

  3. 03Clamp bypassed

    The namespace clamp fails to contain the request to the tenant's namespace.

  4. 04Privileged requests run

    The call executes as the admission-controller ServiceAccount across namespaces and at cluster scope.

  5. 05Cluster admin reached

    Mutating webhooks are created and cluster administration follows.

What happened

Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers can create namespaced Policies whose apiCall runs as the admission-controller ServiceAccount to read other namespaces’ resources and create mutating webhooks, escalating to cluster admin. The record rates it critical at CVSS 9.9 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.

Multi-tenancy is the whole point of Kyverno, and this flaw breaks the boundary between tenants and the cluster itself. The flaw is fixed in Kyverno 1.19.2.

What to do

  1. Inventory Kyverno deployments and record each version.
  2. Upgrade to Kyverno 1.19.2 or later.
  3. Audit Policies with apiCall actions for malformed urlPath values.
  4. Review admission-controller ServiceAccount activity and any mutating webhooks created in the exposure window.
  5. Treat unexpected webhooks or cross-namespace reads as compromise indicators.
  6. Verify the deployed version after updating.

Management note

A tenant-to-cluster-admin escape in the policy engine is a cluster-wide incident, not a single-namespace bug. Check what the admission controller did before assuming the patch closes it.