CVE-2026-122311

Kyverno versions 1.16.0 before 1.19.2 are vulnerable to a path traversal flaw in the resource argument of resource.get() and resource.post(). The root cause is a failure to validate path segments, which allows namespaced CEL policies to escape their intended namespace. An attacker with permission...

PT-2026-137333

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get and resource.post, allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster...