Skip to content
OpenAdvisories
High WID-SEC-2026-3285 5 CVEs

Kyverno: Mehrere Schwachstellen

Published Sep 9, 2026 · Updated Sep 27, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kyverno ausnutzen, um Sicherheitsmaßnahmen zu umgehen, SSRF auszuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren und unter bestimmten Umständen seine Berechtigungen auf Cluster-Administrator zu erweitern.

Product

Kyverno ist eine Open-Source-Richtlinien-Engine für Kubernetes, die Richtlinien als Code validiert, mutiert und generiert.

Vulnerabilities 5

  • Critical 9.9
    CVE-2026-100706

    kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

    kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can…

    kyverno kyverno kyverno-1.17 kyverno-1.18 Wolfi
  • High 7.7
    CVE-2026-100703

    Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

    Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy namespace. …

    kyverno kyverno kyverno-1.17 kyverno-1.18 Wolfi
  • High 7.7
    CVE-2026-100704

    Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass

    Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRef…

    kyverno kyverno kyverno-1.17 kyverno-1.18 Wolfi
  • High 7.7
    CVE-2026-100707

    Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

    Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-segments in ur…

    kyverno kyverno kyverno-1.17 kyverno-1.18 Wolfi
  • High 7.6
    CVE-2026-100705

    Kyverno before 1.19.1 SSRF via legacy apiCall service executor

    Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http.Get/Post lib…

    kyverno kyverno kyverno-1.17 kyverno-1.18 Wolfi

Revision history

  1. #2

    CVE-Nummern ergänzt

  2. #1

    Initiale Fassung

References