CRITICALCVSS v3.1 9.9Vulnerability
CVE-2026-122311
Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster objects using the admission controller's ServiceAccount, leading to cluster takeover.
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-11-05T05:51:13.658545+00:00
- Cvss severity
- CRITICAL
- Cvss score
- 9.9
- Retrieved at
- 2026-11-05T05:52:17+00:00
- Score
- 9.9
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-122311
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- First seen by Signal
- 2026-11-05T05:47:49+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Published at
- 2026-11-05T03:17:23.497
- Last modified
- 2026-11-05T03:17:23.497
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph