CVE-2026-122316
Description
A flaw was found in Kyverno. A missing authorization check in the mutate-existing background processor allows an authenticated user with access to a specific namespace to modify resources outside their assigned boundary. By deploying a mutating policy that targets external resources, an attacker can cause the background controller to alter configurations or remove security controls cluster-wide.
Statement
This vulnerability is rated as an Important impact because it permits authenticated tenants restricted to a single namespace to break multi-tenant isolation and modify cluster-scoped or foreign resources through the privileged background controller. Red Hat Enterprise Linux and OpenShift Container Platform do not ship Kyverno by default, significantly limiting exposure across standard deployments. Where this policy engine is deployed and non-admin users can define mutation rules, the risk is elevated because tenant boundaries can be bypassed to alter cluster-level security settings.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce namespace boundaries and caller authorization checks within Kyverno mutate-existing background processing: upgrade to Kyverno 1.19.2 (or the corresponding fixed Red Hat builds), which restrict mutate-existing target resources to the policy namespace and verify caller permissions before applying mutations, closing all 2 injection vectors (NamespacedMutatingPolicy with CEL target expressions for foreign namespaces, NamespacedMutatingPolicy targeting cluster-scoped objects via mutate-existing). Until patched, this is a concern on Kubernetes clusters running Kyverno with the mutate-existing background controller enabled and tenant access to NamespacedMutatingPolicy resources, so restrict tenant permissions to create or update NamespacedMutatingPolicy resources and monitor background-controller service account mutations across namespace boundaries. As a compensating measure, configure Kubernetes API server audit logging to capture tenant policy creations and background controller modifications to foreign namespaces, deploy validating admission webhooks to inspect NamespacedMutatingPolicy manifests and reject CEL targets defined outside the tenant namespace, enforce application-layer authorization checks using SubjectAccessReview to confirm creator permissions on targeted resources before mutation, and implement infrastructure-as-code drift detection to identify cluster-scoped modifications or stripped Pod Security labels applied outside declared baselines. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing authorization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-907 Application-Layer RBAC Enforcement (medium)
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
