CVE-2026-100706: Path Traversal in Kyverno Policy apiCall Processing

Kyverno versions prior to 1.19.1 are susceptible to a critical path traversal vulnerability within the Policy apiCall component. The vulnerability resides in the insufficient validation of URL-encoded path segments within the 'urlPath' field. This flaw allows a namespace-restricted tenant to bypass enforced namespace boundaries by using percent-encoded directory traversal sequences. When exploited, the attacker effectively elevates their privileges to that of the Kyverno admission-controller ServiceAccount. This level of access allows the attacker to create or modify sensitive cluster-wide resources, including MutatingWebhookConfiguration objects or PolicyException objects within the 'kyverno' namespace, ultimately resulting in full cluster-admin escalation.

Impact

Successful exploitation allows a restricted tenant to break out of their assigned namespace context. This can lead to total cluster compromise through the injection of malicious webhook configurations, which intercept and modify arbitrary Kubernetes API requests, or by creating policy exceptions that disable security controls across the entire cluster.

Recommendation

1. Upgrade all Kyverno deployments to version 1.19.1 or later immediately.
2. Audit current Policy resources for any 'apiCall' configurations utilizing 'urlPath' parameters until patches are applied.
3. Restrict permissions for creating or modifying Kyverno Policy resources to trusted cluster administrators to mitigate the potential impact of the vulnerability while pending upgrades.