CVE-2026-122312

Kyverno versions 1.19.1 before 1.19.2 are vulnerable to a namespace isolation bypass within the APICall Fetch() function located in pkg/engine/apicall/apiCall.go. The root cause is that path.Clean incorrectly treats the '?' character as a path character, allowing namespace regexes to match segmen...