CVE-2026-100706
Description
A flaw was found in Kyverno. An authenticated user with namespace-level permissions can achieve privilege escalation to cluster administrator by supplying encoded path traversal sequences within policy requests. This vulnerability allows an attacker to bypass namespace isolation controls and create unauthorized resources across the cluster using the elevated permissions of the admission controller service account.
Statement
An important privilege escalation flaw was found in Kyverno, affecting the Kyverno container images shipped in Red Hat Konflux. Kyverno fails to properly validate URL-encoded path segments in the apiCall urlPath of namespaced Policy resources. An authenticated attacker with namespace-level permissions, such as a tenant who can create Kyverno Policy objects in their own namespace, can supply percent-encoded path traversal sequences to bypass the per-namespace clamp that is meant to confine such requests, and create objects in other namespaces or cluster-wide using the permissions of the admission controller service account. This can be used, for example, to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, allowing privilege escalation to cluster administrator and bypassing namespace isolation controls. A fix for the affected Konflux Kyverno images is being pursued through the delegated workflow.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Kyverno project has fixed this issue in version 1.19.1.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
