CVE-2026-22039
Critical · 9.9CVSS
9.9
EPSS
0.6%
Published
Jan 27, 2026
CISA due date
—
The record
Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved `urlPath` is executed using the Kyverno admission controller ServiceAccount, with no enforcement that the request is limited to the policy’s namespace. As a result, any authenticated user with permission to create a namespaced Policy can cause Kyverno to perform Kubernetes API requests using Kyverno’s admission controller identity, targeting any API path allowed by that ServiceAccount’s RBAC. This breaks namespace isolation by enabling cross-namespace reads (for example, ConfigMaps and, where permitted, Secrets) and allows cluster-scoped or cross-namespace writes (for example, creating ClusterPolicies) by controlling the urlPath through context variable substitution. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/kyverno/kyverno | 0 | 1.15.3 |
| Go | github.com/kyverno/kyverno | 1.16.0-rc.1 | 1.16.3 |
| Bitnami | kyverno | 0 | 1.15.3 |
| Chainguard | kyverno-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-background-controller-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-background-controller-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-background-controller-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-background-controller-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-background-controller-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-cleanup-controller-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-cleanup-controller-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-cleanup-controller-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-cleanup-controller-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-cli-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-cli-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-cli-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-cli-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-init-container-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-init-container-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-init-container-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-init-container-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-init-container-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-notation-aws | 0 | 1.1-r33 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r32 |
| Chainguard | kyverno-reports-controller-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-reports-controller-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-reports-controller-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-reports-controller-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-reports-controller-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | reports-server | 0 | 0 |
| Wolfi | kyverno-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-background-controller-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-background-controller-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-cleanup-controller-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-cleanup-controller-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-cli-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-cli-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-init-container-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-init-container-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-notation-aws | 0 | 1.1-r33 |
| Wolfi | kyverno-reports-controller-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-reports-controller-1.14 | 0 | 1.14.5-r5 |
| go | github.com/kyverno/kyverno | 1.16.0-rc.1 | 1.16.3 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- CVE-2026-23881 Kyverno is a policy engine designed for cloud native platform engineering teams. Also affects github.com/kyverno/kyverno
- GO-2026-4285 Bypassing Kyverno Policies via Double Policy Exceptions in github.com/kyverno/kyverno Also affects github.com/kyverno/kyverno
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects kyverno-1.14
- CVE-2025-11065 A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing… Also affects kyverno-1.14
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects kyverno-background-controller-fips-1.14
- CVE-2026-24686 go-tuf is a Go implementation of The Update Framework (TUF). Also affects kyverno-background-controller-fips-1.16
- CVE-2026-24137 sigstore framework is a common go library shared across sigstore services and clients. Also affects kyverno-background-controller-fips-1.16
- CVE-2026-24117 Rekor is a software supply chain transparency log. Also affects kyverno-background-controller-fips-1.16