What’s Vulnerable › Vulnerabilities

CVE-2026-41068: Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-24 · updated 2026-06-17
• Weakness: CWE-863

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMap context loader has the identical vulnerability — the `configMap.namespace` field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters. An updated fix is available in version 1.17.2.

Affected products

• kyverno: before 1.17.2 — fixed in 1.17.2

How to fix

Upgrade to a fixed version: kyverno 1.17.2. Check the vendor advisory for mitigations.

References

• https://github.com/kyverno/kyverno/commit/bbf3e5c01391d612968440659028ae98e565a777
• https://github.com/kyverno/kyverno/security/advisories/GHSA-cvq5-hhx3-f99p
• https://github.com/kyverno/kyverno/security/advisories/GHSA-cvq5-hhx3-f99p

Get alerted when CVE-2026-41068 or the next vulnerability affects your stack