{"id":"CVE-2026-124440","summary":"Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass","details":"Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers can create namespaced Policies whose apiCall runs as the admission-controller ServiceAccount to read other namespaces' resources and create mutating webhooks, escalating to cluster admin.","aliases":["GHSA-39w8-hv5g-f73w"],"modified":"2026-11-10T02:45:32.172314789Z","published":"2026-11-08T13:15:33.723Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-441"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/124xxx/CVE-2026-124440.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/124xxx/CVE-2026-124440.json"},{"type":"ADVISORY","url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-39w8-hv5g-f73w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124440"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/kyverno-1.19.1-privilege-escalation-via-apicall-namespace-clamp-bypass"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kyverno/kyverno","events":[{"introduced":"40ec788d48bb28d83dbf85538e962a59db9d45c6"},{"fixed":"e63308f1e16c05cd009ac4864be6ec25c66b49be"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"1.19.1"},{"fixed":"1.19.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"DESCRIPTION","range":[{"introduced":"1.19.1"},{"fixed":"1.19.2"}]}]}}],"versions":["kyverno-policies-chart-3.9.2-rc.5","kyverno-chart-3.9.2-rc.5","v1.19.2-rc.5","v1.19.2-rc3","v1.19.2-rc.4","v1.19.2-rc.1","v1.19.2-rc1","v1.19.1","kyverno-policies-chart-3.9.1","kyverno-chart-3.9.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-124440.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]}