Cloudanix VulnDB

GHSA-cvq5-hhx3-f99p

High · 7.7

Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)

CVSS

7.7

EPSS

—

Published

Apr 16, 2026

CISA due date

—

The record

CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the **ConfigMap context loader has the identical vulnerability** — the `configMap.namespace` field accepts any namespace with zero validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account. This is a complete RBAC bypass in multi-tenant Kubernetes clusters.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities