CVE-2026-122303

Kyverno versions 1.17.0 before 1.19.2 are vulnerable to an authorization bypass in the NamespacedMutatingPolicy component. Specifically, the mutate-existing targetMatchConstraints.expression allows attackers to provide a CEL map literal to fabricate a target with arbitrary metadata. This enables ...

EUVD-2026-117214

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target wit...

PT-2026-137325

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target wit...