BIT-KYVERNO-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

PT-2026-105106

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

CVE-2026-100703

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

CVE-2026-100703

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

CVE-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

EUVD-2026-87676

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

CVE-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

CVE-2026-100703 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...

PT-2026-99374

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.16.0 through 1.19.0 Description The software registers the globalcontext.Lib Common Expression Language CEL library in its policy environment without restricting it to the policy's namespace. This differs from other librarie...

CVE-2026-100703: Exposure of Sensitive Information to an Unauthorized Actor

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries resource.Lib, http.Lib, configMap loader which are handed the policy namespace. A tenant who can create a namespaced...