CVE-2026-124441

CVSS 8.8 (high) · published 2026-11-08

Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged background-controller to write NetworkPolicies or RoleBindings into victim or kube-system namespaces.

Weakness: CWE-863

Source: NVD CVE-2026-124441

References

• https://github.com/kyverno/kyverno/security/advisories/GHSA-vjfx-fp68-rh4v
• https://www.vulncheck.com/advisories/kyverno-before-1.19.2-authorization-bypass-via-variable-generate-target-kind
• https://github.com/kyverno/kyverno/security/advisories/GHSA-vjfx-fp68-rh4v

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.