CVE-2026-122312

Kyverno versions 1.19.1 before 1.19.2 are vulnerable to a namespace isolation bypass within the APICall Fetch() function located in pkg/engine/apicall/apiCall.go. The root cause is that path.Clean incorrectly treats the '?' character as a path character, allowing namespace regexes to match segmen...

EUVD-2026-117223

Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a...

PT-2026-137334

Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a...