Kyverno: Authorization bypass in apiCall (CVE-2026-124440)

Kyverno versions 1.19.1 are affected by a vulnerability in the apiCall namespace clamp. An attacker can bypass authorization constraints by appending malformed percent-escapes to the urlPath parameter within an apiCall. This allows a user with restricted namespace access to issue requests that operate outside their namespace, potentially leveraging the privileges of the Kyverno admission-controller ServiceAccount.

Impact

Successful exploitation allows a namespaced tenant to access resources across the cluster, including sensitive data in other namespaces. Attackers can create mutating webhooks, which leads to full cluster administrator privilege escalation.

Recommendation

• Upgrade Kyverno to version 1.19.2 or later immediately.
• Audit existing Kyverno Policies for any apiCall usage that could be abused to target cross-namespace resources.
• Monitor Kyverno admission controller logs for abnormal API call patterns or unexpected cross-namespace requests.