Vendor
CVE-2026-100706: Path Traversal in Kyverno Policy apiCall Processing
2 TTPs 1 CVEKyverno versions before 1.19.1 contain a path traversal vulnerability in apiCall urlPath processing, enabling namespace-restricted users to perform unauthorized cluster-wide object manipulation via URL-encoded segments.
Kyverno Unvalidated CEL Namespace Argument Vulnerability
1 TTP 1 CVEA vulnerability in Kyverno v1.18.0 and v1.18.1 allows a namespace-scoped user to execute arbitrary resource creation across the entire cluster by exploiting an unvalidated namespace argument in CEL expressions.
Kyverno Controller Denial of Service via forEach Mutation Panic
2 rules 2 TTPsAn unchecked type assertion in Kyverno versions v1.13.0 to v1.17.1 allows a user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller into a persistent CrashLoopBackOff, leading to a denial of service, by crafting a malicious policy that triggers a nil pointer dereference in the forEach mutation handler.
Kyverno apiCall SSRF Leads to Cluster Takeover
2 rules 7 TTPs 3 IOCsA Server Side Request Forgery (SSRF) vulnerability in Kyverno's apiCall feature allows an attacker to exfiltrate the admission controller's ServiceAccount token by creating a ClusterPolicy with a malicious service URL, which can then be used to hijack webhooks, intercept and modify API requests, and potentially access cloud IAM credentials on cloud-hosted clusters, leading to full cluster compromise.