CVE-2026-122312

    Dashboard / Vulnerabilities / CVE-2026-122312

    CVE-2026-122312

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String

    Details: Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch() in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a URLPath like /api/v1/nodes?x=/namespaces/default/ that passes validation while client-go requests the cluster-scoped endpoint, reading resources outside their namespace.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122312.json, https://github.com/kyverno/kyverno/security/advisories/GHSA-pcx2-xcq4-65vf, https://nvd.nist.gov/vuln/detail/CVE-2026-122312, https://www.vulncheck.com/advisories/kyverno-1.19.1-before-1.19.2-namespace-isolation-bypass-via-apicall-urlpath-query-string, https://github.com/kyverno/kyverno/commit/f67231def576eb0ad153dd8cbfc836908ab14c14

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 40ec788d48bb28d83dbf85538e962a59db9d45c6
    Fixed -e63308f1e16c05cd009ac4864be6ec25c66b49be

    Affected versions

    v1.19.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-122312 | CVE-DB