Kyverno: Authorization bypass via variable injection (CVE-2026-124441)

Kyverno versions before 1.19.2 contain an authorization bypass vulnerability (CVE-2026-124441). Namespaced tenants can generate arbitrary Kubernetes resources by injecting variables into a generate rule's kind and namespace fields. This allows an attacker to influence the background-controller, which operates with elevated privileges, to write sensitive resources like NetworkPolicies or RoleBindings into target namespaces, including the kube-system namespace.

Attack Chain

1. Attacker authenticates as a tenant with permissions to create Kyverno Policies within a controlled namespace.
2. Attacker crafts a malicious Kyverno generate rule using variable templating for the target kind and destination namespace.
3. Attacker creates a trigger object, such as a ConfigMap, within their own namespace to activate the rule.
4. The Kyverno background-controller identifies the rule and processes the templated fields.
5. The controller executes the generation logic using its elevated service account privileges.
6. The controller creates or modifies unauthorized resources in the target namespace (e.g., kube-system).

Impact

An attacker can achieve unauthorized privilege escalation and lateral movement within a Kubernetes cluster by creating or modifying critical resources, effectively bypassing namespace boundaries and authorization controls.

Recommendation

• Upgrade Kyverno to version 1.19.2 or later immediately.
• Audit existing Kyverno policies for use of variable templating in the generate rule "kind" and "namespace" fields.
• Restrict the ability to create Kyverno policies within namespaces to trusted service accounts or cluster administrators until the patch is applied.