Skip to content
Threat Feed
Subscribe

Tag

Rbac-Bypass

2 briefs RSS
high advisory

CVE-2026-110215: Privilege Escalation in youlai-boot via Missing Authorization

An authenticated low-privileged user can exploit a missing authorization vulnerability in youlai-boot to assign administrative permissions to their own role and elevate privileges.

youlai-boot privilege-escalation web-application rbac-bypass
1t 1c
high advisory

Kyverno ConfigMap Cross-Namespace Read RBAC Bypass (CVE-2026-22039 Incomplete Fix)

CVE-2026-22039 incompletely fixed a cross-namespace privilege escalation vulnerability in Kyverno's apiCall context, as the ConfigMap context loader still lacks namespace validation, allowing a namespace admin to read ConfigMaps from any namespace using Kyverno's privileged service account, leading to a complete RBAC bypass in multi-tenant Kubernetes clusters.

kyverno rbac-bypass kubernetes privilege-escalation
2r 1t 1c