CVE-2026-100707
Description
A flaw was found in Kyverno. Inconsistent path validation allows an authenticated user with low privileges to bypass namespace isolation boundaries by using percent-encoded directory traversal sequences in policy API requests. An attacker can exploit this issue to access and read sensitive Kubernetes resources from unauthorized namespaces using the elevated permissions of Kyverno's service account.
Statement
Red Hat rates this Kyverno flaw as IMPORTANT. A namespace-isolation check on the apiCall context entry of namespaced Policy resources can be bypassed using percent-encoded dot-segments in urlPath because the validation check normalizes the path lexically while the executed API request percent-decodes it. A low-privilege tenant who can create namespaced Policy resources in their own namespace, and who has no access to other namespaces, can make Kyverno read Kubernetes resources, such as ConfigMaps, from other namespaces using the admission controller's ServiceAccount credentials. The exposure grows with the permissions granted to that ServiceAccount, and the issue primarily affects multi-tenant clusters where namespaced policy creation is delegated to tenants. The Kyverno container images shipped in Red Hat's Konflux are affected and a fix is being pursued for those products. Red Hat's CVSS v3 score of 7.7 matches the upstream advisory's score; the CVSS v4 score of 8.3 in the CVE record reflects a different scoring methodology rather than a different assessed severity.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able to read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
