CVE-2026-122310

    Dashboard / Vulnerabilities / CVE-2026-122310

    CVE-2026-122310

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath

    Details: Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # or ? to reach cluster-scoped endpoints with Kyverno's ServiceAccount, gaining cluster admin.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122310.json, https://github.com/kyverno/kyverno/security/advisories/GHSA-3xfv-vq8x-qhg4, https://nvd.nist.gov/vuln/detail/CVE-2026-122310, https://www.vulncheck.com/advisories/kyverno-1.19.1-before-1.19.2-privilege-escalation-via-policy-apicall-urlpath

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 40ec788d48bb28d83dbf85538e962a59db9d45c6
    Fixed -e63308f1e16c05cd009ac4864be6ec25c66b49be

    Affected versions

    kyverno-policies-chart-3.9.2-rc.5
    kyverno-policies-chart-3.9.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-122310 | CVE-DB