Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: kyverno 1.19.1 Clear all filters
TI-2026-64863 CVE-2026-100707 · GHSA-66wc-m66q-pf76

Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

Priority HIGH 69

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.0046 Published 2026-09-26 Fixed in 1.19.1 CWE-22
TI-2026-64862 CVE-2026-100706 · GHSA-j68q-wq49-88gg

kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

Priority MEDIUM 43

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-c…

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00613 Published 2026-09-26 Fixed in 1.19.1 CWE-441
TI-2026-64859 CVE-2026-100703 · GHSA-cmr3-jwxg-m6m3

Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Priority LOW 35

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader)…

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00227 Published 2026-09-26 Fixed in 1.19.1 CWE-200