CVE-2026-122311

    Dashboard / Vulnerabilities / CVE-2026-122311

    CVE-2026-122311

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument

    Details: Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122311.json, https://github.com/kyverno/kyverno/security/advisories/GHSA-4pqm-wqq6-h9q2, https://nvd.nist.gov/vuln/detail/CVE-2026-122311, https://www.vulncheck.com/advisories/kyverno-1.16.0-before-1.19.2-path-traversal-in-namespaced-cel-policies-via-resource-argument

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 18f9549cb2af30ec0537cd97f3200228d9f42d4b
    Fixed -e63308f1e16c05cd009ac4864be6ec25c66b49be

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-122311 | CVE-DB