CVE-2026-100706
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall…
- Risk score
- 69/100
- CVSS
- 9.9 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 26 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal s…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.19.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.9 critical
References
Original description
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded directory traversal sequences to create MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, enabling privilege escalation to cluster admin.
Last activity 26 Sep 2026. Patch Forecast updates every hour.